# CVE-2026-50254: OFFIS DCMTK memory leak in storescp service

Source: https://junglewise.ai/threats/cve-2026-50254-offis-dcmtk-memory-leak-in-storescp-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-50254 · Severity: high · CVSS 7.5 · Published 2026-06-30

A vulnerability in the DCMTK medical imaging toolkit allows an unauthenticated attacker to crash the 'storescp' service, which is used to receive and store medical images. By sending specially crafted connection requests, an attacker can cause the system to run out of memory, leading to a service outage that requires a manual restart by an operator. This could disrupt clinical workflows and the availability of medical data in healthcare environments.

## Quick answers

**Is CVE-2026-50254 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50254 being exploited in the wild.

**How severe is CVE-2026-50254?** High severity, with a CVSS score of 7.5, published 30 June 2026.

**Which products and versions are affected?** OFFIS DICOM DCMTK Toolkit <= 3.7.0.

**Is there a fix for CVE-2026-50254?** A patch was published on 2026-06-25: Fix included in latest repository commits/snapshots. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50254 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50254?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory leak vulnerability (CWE-401) exists in the OFFIS DCMTK Toolkit, specifically affecting the 'storescp' component. An unauthenticated remote attacker can exploit this by sending a series of crafted connection requests over the network. In the default single-process mode, these requests cause rapid memory consumption until the process is terminated by the operating system. Once the service is killed, it stops accepting new DICOM connections until manually restarted. The maintainer has released a fix available in the latest GitHub repository snapshots.

## Affected products

- OFFIS DICOM DCMTK Toolkit <= 3.7.0

## Timeline

- 2026-06-25: patched: Fix included in latest repository commits/snapshots.
- 2026-06-30: advisory: CISA ICS Medical Advisory ICSMA-26-181-01 published.
- 2026-06-30: disclosed: CVE-2026-50254 published to NVD.

## References

- [https://github.com/DCMTK/dcmtk/releases/tag/latest](https://github.com/DCMTK/dcmtk/releases/tag/latest)
- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01)