CVE-2026-3650 Grassroots DICOM Missing release of memory after effective lifetime
Attackers can cause denial of service in applications using GDCM by sending malformed DICOM files that trigger memory leaks and resource depletion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3650?
CVE-2026-3650 is a high-severity denial of service vulnerability in Grassroots DICOM (GDCM), published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggering a denial-of-service condition. A maliciously crafted file can fill the heap in a single read operation without properly releasing it.
Weakness: CWE-401
Which versions are affected by CVE-2026-3650?
Linux distribution packages (1)
insighttoolkit openSUSE:Tumbleweed | All versions | 5.4.7-1.1 |
How do I fix CVE-2026-3650?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-3650 being exploited?
There is no known exploitation of CVE-2026-3650 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-3650, GHSA-42p8-rv8p-8h4j, UBUNTU-CVE-2026-3650, openSUSE-SU-2026:11701-1.