CVE-2026-44038 Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding
Attackers can cause crashes or read out-of-bounds memory via crafted DICOM files in DCMTK due to missing Huffman table range checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-44038?
CVE-2026-44038 is a medium-severity memory corruption vulnerability in OFFIS DCMTK, published on 8 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM file with a crafted JPEG stream whose Huffman table defines a difference category above 15. Huffman symbol values are not range-checked unless DCMTK is built with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK, which is disabled by default. dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK are affected. The issue is fixed in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.
Weakness: CWE-125
Which versions are affected by CVE-2026-44038?
How do I fix CVE-2026-44038?
No fix has been published for CVE-2026-44038 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-44038 being exploited?
There is no known exploitation of CVE-2026-44038 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-44038, GHSA-4mfc-mxcx-mmpp, UBUNTU-CVE-2026-44038.