#DICOM
All CosmicBytez Labs articles tagged #DICOM, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-46350: dcmjs DICOM Parser Accepts Infinity and NaN Values
dcmjs before 0.52.0 passes unvalidated DecimalString and IntegerString values to Number, letting crafted DICOM data inject Infinity or NaN. CVSS 9.1.
- Security
CVE-2026-48705: MONAI Trusts Non-Finite DICOM Values, Corrupting Outputs
MONAI before 1.6.1 builds affine matrices from unvalidated DICOM fields. A crafted upload to a default MONAILabel deployment can poison outputs. CVSS 9.3.
- Security
CVE-2026-97851: dcm4chee-arc-light Storage API Lets Attackers Purge Medical Images Without Authorization
A REST state-change flaw in dcm4chee-arc-light deletes stored DICOM images while database records survive, causing silent, irrecoverable data loss.
- Security
CVE-2026-105279: dcm4chee-arc-light DICOM Archive Accepts Unauthenticated Peer Connections
dcm4chee-arc-light trusts any DICOM peer by default, letting attackers enumerate patients, pull images, and plant fabricated studies.
- Security
CVE-2026-56445: DICOM qrscp Path Traversal Enables Arbitrary File Write
A critical path traversal vulnerability in the qrscp DICOM application allows unauthenticated attackers to write files to arbitrary server paths via...
- News
Orthanc DICOM Vulnerabilities Lead to Crashes, RCE
Multiple vulnerabilities in the widely-used Orthanc open-source DICOM server expose medical imaging systems to denial-of-service, information disclosure,...