CVE-2026-52868: Offis Dicom Dcmtk Toolkit

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.

Affected products

• Offis Dicom Dcmtk Toolkit: up to and including 3.7.0

Published 2026-06-30. Last modified 2026-07-01.