CVE-2026-3650

CVE-2026-3650 identifies a high-severity memory leak (CWE-401) in the Grassroots DICOM (GDCM) library. This vulnerability is triggered when parsing malformed DICOM files with non-standard VR types, leading to vast memory allocations, resource depletion, and a denial-of-service condition. With a CVSS score of 7.5 (High), it can be exploited remotely over the network with low attack complexity, requiring no user interaction or privileges. There is no evidence of active exploitation or public exploit code, though the CVE has garnered community attention with 46 mentions and one media article.