[Debian-med-packaging] Bug#1149131: dcmtk: CVE-2026-97059

[Salvatore Bonaccorso]

Source: dcmtk
Version: 3.7.0+really3.7.0-7
Severity: important
Tags: security upstream
Forwarded: https://support.dcmtk.org/redmine/issues/1281
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for dcmtk.

CVE-2026-97059[0]:
| DCMTK through 3.7.0 contains a heap over-read vulnerability in
| ConcatenationLoader that copies pixel data frames without validating
| the PixelData buffer length against the declared NumberOfFrames.
| Attackers can craft malicious DICOM instances declaring more frames
| than the buffer contains to trigger heap over-reads that crash the
| application or leak adjacent heap memory.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-97059
    https://www.cve.org/CVERecord?id=CVE-2026-97059
[1] https://support.dcmtk.org/redmine/issues/1281
[2] https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285
[3] https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore