This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-12805 →

DEBIAN-CVE-2026-12805

A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Execut...

Original description

The description as published by the source.

A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a manipulation can lead to heap-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. This patch is called 1d4b3815c0987840a983160bfc671fef63a3105b. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-9~deb12u4"}]}]

Debian:13 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-5+deb13u2"}]}]

Debian:14 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0+really3.7.0-6"}]}]

References

advisory security-tracker.debian.org