Overview
CVE-2026-46350 affects dcmjs, a JavaScript library for reading and manipulating DICOM medical imaging data. It was published on November 5, 2026 through GitHub advisory GHSA-px68-xx5g-48q5 with a CVSS 3.1 score of 9.1 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The weaknesses are CWE-20 (improper input validation) and CWE-1284. NVD analysis was not complete at the time of writing.
Affected Versions
| Product | Affected | Fixed |
|---|---|---|
| dcmjs | All versions before 0.52.0 | 0.52.0 |
Technical Summary
The DecimalString (DS) and IntegerString (IS) handlers in src/ValueRepresentation.js clean input text with a permissive regular expression and then hand the result to JavaScript's Number constructor. They do not check that the result is finite or that it follows DICOM value representation rules.
- Exponent overflow in a DS value can produce positive or negative
Infinity. - Stripping letters from text such as signed infinity can leave a sign-only string, which becomes
NaN. - IS values accept exponent notation and numbers outside the signed 32-bit range.
Applications that trust these parsed values can carry invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction. The result is wrong calculations or disrupted processing. In a clinical or research imaging workflow, silently wrong numbers are the real hazard, since viewers and pipelines may keep running on corrupted data.
Remediation
- Upgrade dcmjs to 0.52.0 or later.
- Until upgraded, validate parsed numeric DICOM fields in your own code and reject values that are not finite or are outside the range the tag allows.
- Treat DICOM files from untrusted sources, including uploads and shared studies, as hostile input.
- Check downstream consumers of dcmjs output, such as viewers and dose or geometry calculations, for NaN and Infinity handling.
References
- NVD: CVE-2026-46350
- GitHub Security Advisory GHSA-px68-xx5g-48q5