CVE-2026-12805

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-12805
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12805.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-12805
Downstream
Published
2026-06-21T19:15:07Z
Modified
2026-08-12T15:31:17Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
OFFIS DCMTK ofxml.cc parseFile heap-based overflow
Details

A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a manipulation can lead to heap-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. This patch is called 1d4b3815c0987840a983160bfc671fef63a3105b. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12805.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.0"
                },
                {
                    "last_affected": "3.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/dcmtk/dcmtk

Affected ranges

Type
GIT
Repo
https://github.com/dcmtk/dcmtk
Events
Introduced
06a43898150d5f02b740c0ebb75faba1c1609ec2
Fixed
1d4b3815c0987840a983160bfc671fef63a3105b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.1"
        },
        {
            "last_affected": "3.1"
        },
        {
            "introduced": "3.2"
        },
        {
            "last_affected": "3.2"
        },
        {
            "introduced": "3.3"
        },
        {
            "last_affected": "3.3"
        },
        {
            "introduced": "3.4"
        },
        {
            "last_affected": "3.4"
        },
        {
            "introduced": "3.5"
        },
        {
            "last_affected": "3.5"
        },
        {
            "introduced": "3.6"
        },
        {
            "last_affected": "3.6"
        },
        {
            "introduced": "3.7.0"
        },
        {
            "last_affected": "3.7.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.1
3.2
3.3
3.4
3.5
3.6
3.7.0
DCMTK-3.*
DCMTK-3.1.0
DCMTK-3.1.1
DCMTK-3.1.2
DCMTK-3.2.0
DCMTK-3.2.1
DCMTK-3.3.0
DCMTK-3.3.1
DCMTK-3.4.0
DCMTK-3.4.1
DCMTK-3.4.2
DCMTK-3.5.0
DCMTK-3.5.1
DCMTK-3.5.2
DCMTK-3.5.2a
DCMTK-3.5.3
DCMTK-3.5.4
DCMTK-3.6.0
DCMTK-3.6.1_20110225
DCMTK-3.6.1_20110519
DCMTK-3.6.1_20110707
DCMTK-3.6.1_20110922
DCMTK-3.6.1_20111208
DCMTK-3.6.1_20120222
DCMTK-3.6.1_20120515
DCMTK-3.6.1_20120831
DCMTK-3.6.1_20121102
DCMTK-3.6.1_20131114
DCMTK-3.6.1_20140617
DCMTK-3.6.1_20150217
DCMTK-3.6.1_20150629
DCMTK-3.6.1_20150924
DCMTK-3.6.1_20160216
DCMTK-3.6.1_20160630
DCMTK-3.6.1_20161102
DCMTK-3.6.1_20170228
DCMTK-3.6.2
DCMTK-3.6.3
DCMTK-3.6.4
DCMTK-3.6.5
DCMTK-3.6.5+_20191213
DCMTK-3.6.6
DCMTK-3.6.7
DCMTK-3.6.8
DCMTK-3.6.9
DCMTK-3.7.0
Other
latest

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12805.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "136178353674991954182774895568563408942",
                "1813495633018274494577294268187639910",
                "17219925503649223774901649055358230295",
                "273449713842945651065265665876388653094",
                "201591129433885799828120164722939724222",
                "48369371243509604281809611266489642347",
                "34412667060146742152604197786008107318",
                "59703542316442139539386387167853677595",
                "237608696658239368450606907245376453743",
                "8286506465920977247968394318858062847",
                "246672110927093683316069466146835903729",
                "175366735059787346364536590268931268298",
                "334433211777008840804920216935220819411"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-12805-5be914ad",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/1d4b3815c0987840a983160bfc671fef63a3105b",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "288273921168231333003188998079046166292",
            "length": 2424
        },
        "id": "CVE-2026-12805-8b74a39e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/1d4b3815c0987840a983160bfc671fef63a3105b",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc",
            "function": "XMLNode::parseFile"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:31:17Z"