Skip to content
OpenAdvisories
Critical ICSMA-26-288-02 6 CVEs

J4Care dcm4che

Published Oct 15, 2026 · Updated Oct 15, 2026

Vendor: J4Care Product: dcm4chee-arc-light

Summary

Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition.

Vulnerabilities 6

  • Critical 9.1
    CVE-2026-105279

    J4Care dcm4che Missing Authentication for Critical Function

    In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study con…

    J4Care dcm4chee-arc-light
  • Critical 9.1
    CVE-2026-97851

    J4Care dcm4che Missing Authorization

    The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even thou…

    J4Care dcm4chee-arc-light
  • High 7.5
    CVE-2026-101021

    J4Care dcm4che Inefficient Algorithmic Complexity

    MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

    J4Care dcm4chee-arc-light
  • High 7.5
    CVE-2026-105273

    J4Care dcm4che Loop with Unreachable Exit Condition

    MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

    J4Care dcm4chee-arc-light
  • High 7.5
    CVE-2026-105667

    J4Care dcm4che Missing Authentication for Critical Function

    In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge…

    J4Care dcm4chee-arc-light
  • High 7.5
    CVE-2026-107621

    J4Care dcm4che Loop with Unreachable Exit Condition

    JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.

    J4Care dcm4chee-arc-light

Revision history

  1. #1

    Initial Publication

References