CVE-2026-3650
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Mar 26, 2026
CISA due date
—
The record
A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggering a denial-of-service condition. A maliciously crafted file can fill the heap in a single read operation without properly releasing it.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109278 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the… CWE-401
- CVE-2026-109270 ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option… CWE-401
- CVE-2026-109262 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG… CWE-401
- CVE-2026-109263 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV… CWE-401
- CVE-2026-109261 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF… CWE-401
- CVE-2026-109260 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG… CWE-401
- CVE-2026-104874 Multidict is an implementation of a multidict data structure. CWE-401
- CVE-2026-98162 In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree… CWE-401