CVE-2026-22879

Published: Jun 25, 2026Modified: Sep 23, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: CNA (Secondary)

Description

A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom (version(s): 9.5.2). A specially crafted DICOM file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

Related CWEs

CWE-129

Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References (2)

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2366

Source: talos-cna@cisco.com

https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2366

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.