dcm4chee-arc-light EUVD-2026-102891

Exploitation requires the attacker to deliver a maliciously crafted or truncated JPEG-encoded stream to dcm4chee-arc-light's JPEGParser - i.e., the deployment must expose a DICOM/image-ingestion path that parses attacker-supplied image data. Per the provided vector (PR:N/UI:N) no authentication or user interaction is required and exploitation works against default behavior, but realistic risk is limited by network reachability: the vulnerable service must be reachable from the attacker's position (untrusted network or internet exposure rather than a segmented clinical VLAN). Impact is confined to availability (VA:H; VC:N/VI:N) - a hang/resource exhaustion, not code execution or data compromise.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes a network-reachable, low-complexity, unauthenticated flaw with availability-only impact and no confidentiality or integrity consequence - consistent with the CWE-835 infinite-loop/denial-of-service classification and the 'Denial Of Service' tag. The 8.7 base score is driven almost entirely by the high availability impact combined with the unauthenticated network vector; this is a genuine availability concern but NOT a code-execution or data-breach issue. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active or widespread exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (network DoS, no conflicting local-access language in the description), so the main caveat is deployment context rather than metric contradiction: real-world priority depends heavily on whether the dcm4chee-arc-light DICOM service is exposed to untrusted networks. For internet- or broadly-network-exposed medical imaging archives this warrants prompt patching; for segmented clinical networks the realistic risk is lower. Note that PR:N assumes the vulnerable parser processes streams without prior authentication, which should be confirmed against the actual DICOM association/service configuration.

An attacker able to reach the dcm4chee-arc-light service over the network sends a specially crafted or truncated JPEG-encoded stream to the JPEGParser, which enters an infinite loop and consumes CPU resources, hanging or starving the processing thread. Repeated or concurrent submissions can degrade or deny availability of the DICOM archive used for medical image storage and retrieval. No public exploit code is identified in the provided data, and the impact is limited to denial of service with no confidentiality or integrity effect.