---
id: CVE-2026-44038
title: >-
  A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG
  libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows
  an attacker to read memory beyond the extend_test[] and extend_offset[]
  tables, cau…
summary: >-
  A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG
  libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows
  an attacker to read memory beyond the extend_test[] and extend_offset[]
  tables, cau…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'
cwe:
  - CWE-125
vendor: OFFIS
product: DCMTK
affected:
  - DCMTK 3.7.0
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:10:00.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44038'
references:
  - url: >-
      https://github.com/DCMTK/dcmtk/commit/d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5
    label: 33c584b5-0579-4c06-b2a0-8d8329fcab9c
  - url: 'https://support.dcmtk.org/redmine/issues/1221'
    label: 33c584b5-0579-4c06-b2a0-8d8329fcab9c
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T14:08:11.020411Z'
ingestedAt: '2026-10-08T13:42:55.146Z'
---

## Overview

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM file with a crafted JPEG stream whose Huffman table defines a difference category above 15. Huffman symbol values are not range-checked unless DCMTK is built with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK, which is disabled by default. dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK are affected. The issue is fixed in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.