CISA Alert ICSMA-26-181-01: OFFIS DCMTK Path Traversal & Type Confusion Vulnerabilities

Vulnerability Overview Vulnerability Name: OFFIS DCMTK Toolkit Vulnerability Publication Date: June 30, 2026 Alert Code: ICSMA-26-181-01 Related Topics: Industrial Control Systems (ICS) Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: DCMTK <= 3.7.0 CVSS Score: v3 9.8 Vendor: OFFIS Device: OFFIS DCMTK Toolkit Vulnerability Details: - Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) - Missing Release of Resource after Effective Lifetime (Use After Free) - Accessing Resource with Incompatible Type (Type Confusion) Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote access methods, such as Virtual Private Networks (VPNs), and recognize that VPNs may have vulnerabilities and should be updated to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying defenses. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspected malicious activities, and track and correlate these events. - Take the following steps to protect yourself from social engineering attacks: - Do not click on web links in unsolicited email messages or open attachments. - Refer to "Identifying and Avoiding Email Scams" for more information. - Refer to "Avoiding Social Engineering and Phishing Attacks" for more information. Additional Information Background: - Critical Infrastructure Sector: Healthcare and Public Health - Deployed Countries/Regions: Global - Company Headquarters Location: Germany Acknowledgements: - Abhinav Agarwal reported these vulnerabilities to CISA Revision History: - Initial Publication Date: 2026-06-30 - Revision 1: Initial Release Tags Industry: Healthcare and Public Health Industry Topics: Industrial Control Systems (ICS) Vulnerabilities, Industrial Control Systems Related Advisories pydicom pyndtcm Library OHIF Viewers DICOM Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Fourth Frontier Frontier X Mobile Application, Frontier X2 Legal Notice and Terms of Use This product is subject to this notice and privacy and usage policies. Vendor OFFIS Feedback Share your thoughts: We have recently updated our anonymous product survey and welcome your feedback. Related Links Back to Top Topics, Highlights, Resources & Tools, News & Events, Careers, About Footer CISA Central 1-844-Say-CISA contact@cisa.dhs.gov Official Statement CISA.gov Official Website of the U.S. Department of Homeland Security Additional Links About CISA Budget & Performance OIG.gov FOIA Requests No FEAR Act Inspector General's Office Privacy Policy Subscribe White House USA.gov Website Feedback --- Note: POC code or exploit code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

CISA Alert ICSMA-26-181-01: OFFIS DCMTK Path Traversal & Type Confusion Vulnerabilities