High severity7.5NVD Advisory· Published Jun 30, 2026· Updated Jul 1, 2026

CVE-2026-44628

Description

An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.

Affected products

Debian/dcmtkllm-create

Patches

Vulnerability mechanics

References

github.com/DCMTK/dcmtk/releases/tag/latestnvd
github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.jsonnvd
www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01nvd

News mentions

DICOM Toolkit Bugs Raise Medical Imaging Security Risks
GovInfoSecurity · Jun 30, 2026
OFFIS DCMTK Toolkit
CISA Alerts

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000