SEC-01Executable in the preamble is never passed on

What this test proves

CVE-2019-11687: the 128-byte preamble of a DICOM file can hold a Windows PE or Linux ELF header, so one file can be both an image and a program. DicomKit must read such files normally and never copy that preamble into anything it writes.

How it is tested

Use two copies of the CT test image (64 x 64, 16-bit) whose preambles hold a PE header (MZ, PE\0\0 at 0x40) and an ELF64 header; written by the test-data script, they contain no program code
Open both with DicomFile.OpenAsync: no parse errors, PatientName, SOP Instance UID and pixel SHA-256 as in the source
Write each through every output path: SaveAsync; C-STORE to a loopback DicomServer whose handler uses WritePart10Async and OpenAsync + SaveAsync; DICOMweb STOW-RS into the file-system store and WADO-RS back (Enterprise and Developer); DicomAnonymizer + SaveAsync; the batch processor; dicomkit anonymize and dicomkit store
Pass if every output's first 128 bytes are zero, DICM follows, and the pixel SHA-256 equals the input's
Reference: CVE-2019-11687 (NVD/MITRE record; Cylera Labs report of 2019-04-16)

Expected result for each license type

No key: Asks for key: stops and asks for a license key
Developer: Works
Pro: Works
Enterprise: Works
Expired: Works
Revoked: Works

Results

License	Expected	.NET 8.0	.NET 9.0	.NET 10.0	Result
No key	Asks for key	Pass Asked for key	Pass Asked for key	Pass Asked for key	Pass
Developer	Works	Pass Worked	Pass Worked	Pass Worked	Pass
Pro	Works	Pass Worked	Pass Worked	Pass Worked	Pass
Enterprise	Works	Pass Worked	Pass Worked	Pass Worked	Pass
Expired	Works	Pass Worked	Pass Worked	Pass Worked	Pass
Revoked	Works	Pass Worked	Pass Worked	Pass Worked	Pass

Recorded evidence

Captured by the automated test during the run, per license and .NET version.

License	.NET	Captured	Time
No key	.NET 8.0	DicomKitLicenseException: DicomKit needs a license key. Get a free Developer key at https://dicomkit.plogic.dev/DeveloperKey (paid plans for production: https://dicomkit.plogic.dev/Pricing; license state KeyRequired (NoKey) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [none] [net8.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "none")"	3 ms
No key	.NET 9.0	DicomKitLicenseException: DicomKit needs a license key. Get a free Developer key at https://dicomkit.plogic.dev/DeveloperKey (paid plans for production: https://dicomkit.plogic.dev/Pricing; license state KeyRequired (NoKey) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [none] [net9.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "none")"	3 ms
No key	.NET 10.0	DicomKitLicenseException: DicomKit needs a license key. Get a free Developer key at https://dicomkit.plogic.dev/DeveloperKey (paid plans for production: https://dicomkit.plogic.dev/Pricing; license state KeyRequired (NoKey) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [none] [net10.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "none")"	3 ms
Developer	.NET 8.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: STOW-RS, file in the file-system store) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: WADO-RS (application/dicom)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [developer] [net8.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "developer")"	338 ms
Developer	.NET 9.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: STOW-RS, file in the file-system store) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: WADO-RS (application/dicom)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [developer] [net9.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "developer")"	394 ms
Developer	.NET 10.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: STOW-RS, file in the file-system store) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: WADO-RS (application/dicom)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [developer] [net10.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "developer")"	396 ms
Pro	.NET 8.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [pro] [net8.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "pro")"	315 ms
Pro	.NET 9.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [pro] [net9.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "pro")"	370 ms
Pro	.NET 10.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [pro] [net10.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "pro")"	368 ms
Enterprise	.NET 8.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: STOW-RS, file in the file-system store) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: WADO-RS (application/dicom)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [enterprise] [net8.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "enterprise")"	327 ms
Enterprise	.NET 9.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: STOW-RS, file in the file-system store) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: WADO-RS (application/dicom)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [enterprise] [net9.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "enterprise")"	411 ms
Enterprise	.NET 10.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: STOW-RS, file in the file-system store) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: WADO-RS (application/dicom)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [enterprise] [net10.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "enterprise")"	393 ms
Expired	.NET 8.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [expired] [net8.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "expired")"	316 ms
Expired	.NET 9.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [expired] [net9.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "expired")"	370 ms
Expired	.NET 10.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [expired] [net10.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "expired")"	361 ms
Revoked	.NET 8.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [revoked] [net8.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "revoked")"	320 ms
Revoked	.NET 9.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [revoked] [net9.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "revoked")"	370 ms
Revoked	.NET 10.0	inputs: polyglot_pe_ct_64x64.dcm (PE header in the preamble), polyglot_elf_ct_64x64.dcm (ELF header in the preamble); both parse without errors; PatientName, SOPInstanceUID and pixel SHA-256 intact path DICOMweb STOW-RS/WADO-RS: not run (this license tier has no DICOMweb server; the server answers 402) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomFile.SaveAsync(Stream)) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, WritePart10Async) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: C-STORE, OpenAsync+SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomAnonymizer + SaveAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: DicomBatchProcessor.AnonymizeAsync) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit anonymize) PE+ELF header in input preamble; output preamble 128 zero bytes; pixel SHA-256 equal (path: dicomkit store -> SCP WritePart10Async) Test: DicomKit.ReleaseTests.ReleaseMatrix.Case "SEC-01 [revoked] [net10.0] Executable in the preamble is never passed on(caseId: "SEC-01", license: "revoked")"	366 ms

Test run

Run: 2ce13edc-f525-4ffb-ae07-648e5221cef9
Started (UTC): 2026-10-26 21:15:23, finished 21:21:01
Source commit: b804fb7
Environment: Microsoft Windows 11 Pro 10.0.26200 build 26200; Microsoft.AspNetCore.App 8.0.29, Microsoft.AspNetCore.App 9.0.18, Microsoft.AspNetCore.App 10.0.12, Microsoft.NETCore.App 3.1.32, Microsoft.NETCore.App 8.0.3, Microsoft.NETCore.App 8.0.29, Microsoft.NETCore.App 9.0.18, Microsoft.NETCore.App 10.0.12, Microsoft.WindowsDesktop.App 8.0.3, Microsoft.WindowsDesktop.App 8.0.29, Microsoft.WindowsDesktop.App 9.0.18, Microsoft.WindowsDesktop.App 10.0.12; Visual Studio Community 2026 18.10.3 (18.10.12224.181)
DicomKit: 1.0.0 SHA-256 96ada39062c07bca37511abfb6baac0a44d914fb705bac01d77cb02146fdac0e
DicomKit.Cli: 1.0.0 SHA-256 f8ffe70dc375cfe0d60881027e7cedb2502bc78ec5f5037f1d41b6c2481e1c84
DicomKit.Imaging: 1.0.0 SHA-256 015b51ea833039d934ba153cae50d393fb77846430ca3fc3d65b4fb8cf4346ed
DicomKit.Web: 1.0.0 SHA-256 2a2f4f7f02e1849929294062bee7dd8f3a24449428469c1fddb6982e77218a7b
DicomKit.Web.AspNetCore: 1.0.0 SHA-256 daa1105881f1c0b60ca9c788d52d41445bd653a9d190c8862a2b2b1386d5e37c

Resources

README Runnable console samples Release notes Release test report Issue tracker NuGet packages

Found something that doesn't work as listed? Report an issue.