High severity7.5NVD Advisory· Published Jun 30, 2026· Updated Jul 1, 2026

CVE-2026-50254

Description

An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.

Affected products

Debian/dcmtkllm-create

Patches

Vulnerability mechanics

References

github.com/DCMTK/dcmtk/releases/tag/latestnvd
github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.jsonnvd
www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01nvd

News mentions

DICOM Toolkit Bugs Raise Medical Imaging Security Risks
GovInfoSecurity · Jun 30, 2026
OFFIS DCMTK Toolkit
CISA Alerts

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000