Is CVE-2026-50003 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50003 being exploited in the wild.

How severe is CVE-2026-50003?

Critical severity, with a CVSS score of 9.8, published 30 June 2026.

Is there a fix for CVE-2026-50003?

A patch was published on 2026-06-25: Fix included in latest commits/snapshots on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50003 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50003?

Check whether you run OFFIS DCMTK Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50003: OFFIS DCMTK path traversal in C-GET storage mode

CVE-2026-50003 · Severity: critical · CVSS 9.8 · Published 2026-06-30

OFFIS DCMTK is a widely used toolkit for processing and transmitting medical images in the DICOM format. A vulnerability has been identified where a malicious or compromised server can force a client to save files in unauthorized locations on its computer. This could allow an attacker to overwrite critical system files or plant malicious software, potentially leading to a full system takeover or data loss in healthcare environments.

Technologies: OFFIS DCMTK Toolkit. Vendors: OFFIS.

Quick answers

Is CVE-2026-50003 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50003 being exploited in the wild.
How severe is CVE-2026-50003?: Critical severity, with a CVSS score of 9.8, published 30 June 2026.
Which products and versions are affected?: OFFIS DCMTK Toolkit <= 3.7.0.
Is there a fix for CVE-2026-50003?: A patch was published on 2026-06-25: Fix included in latest commits/snapshots on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50003 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50003?: Check whether you run OFFIS DCMTK Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the OFFIS DCMTK Toolkit when a client utilizes bit-preserving C-GET storage mode. The root cause is improper validation of file paths provided by a DICOM server during data transfer. An attacker controlling a malicious server can send crafted responses containing relative (../) or absolute paths, forcing the client to write files outside of the intended destination directory. This can be exploited remotely without authentication if a client connects to a compromised server, potentially resulting in arbitrary file creation or overwriting. A fix has been provided in the latest DCMTK source snapshots on GitHub.

Affected products

OFFIS DCMTK Toolkit <= 3.7.0

Timeline

2026-06-25: patched: Fix included in latest commits/snapshots on GitHub
2026-06-30: advisory: CISA ICS Medical Advisory ICSMA-26-181-01 published
2026-06-30: disclosed: CVE-2026-50003 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.