dcm4chee-arc-light CVE-2026-105273

Exploitation requires an attacker to deliver a crafted MP4 structure with a malformed box size to the MP4Parser component within dcm4chee-arc-light - in practice an MP4 stream encapsulated in a DICOM object submitted to the archive's receiving/parsing services. Per the CVSS vector (AV:N/PR:N/UI:N) no authentication or user interaction is required, so any actor able to reach a service endpoint that accepts and parses media objects can trigger it. The principal limiting factor is reachability: the target must expose a DICOM/media ingestion interface to the attacker and must actually invoke MP4 parsing on the supplied object; impact is confined to availability (service hang/CPU exhaustion), with no confidentiality or integrity consequence.

This is a network-reachable, unauthenticated availability-only vulnerability (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H), classifying it as CWE-835 (infinite loop / uncontrolled resource consumption). The VA:H with zero confidentiality and integrity impact confirms this is a pure denial-of-service condition, not code execution or data exposure. The headline CVSS 4.0 base score of 8.7 is driven almost entirely by the easy, unauthenticated, low-complexity network vector rather than by severe impact - a high score that reflects reachability, not compromise. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals means the 8.7 should be read as theoretical reachability rather than demonstrated in-the-wild risk. The CVSS vector (AV:N) and the description (malformed MP4 box causing no forward progress) are consistent - both point to remotely supplied malformed media triggering the loop. The practical priority is moderated by context: this affects a healthcare DICOM archive (dcm4chee-arc-light) and was reported via CISA ICS-CERT medical advisory, so for affected medical-imaging operators availability loss can be clinically significant, but the absence of exploitation signals suggests this is a patch-in-normal-cycle item rather than an emergency unless the service is internet-exposed.

A remote attacker submits a DICOM/media object containing a malformed MP4 box with an invalid size field to a dcm4chee-arc-light instance that parses it. Because the parser makes no forward progress, it repeatedly reprocesses the same input, consuming CPU and hanging the parsing thread, causing a denial of service against the archive. No public exploit code was identified at time of analysis, and no authentication is required per the CVSS vector.