Dcm4Chee Arc Light
Monthly
Unauthenticated HL7 ADT^A40 patient-merge messages accepted by the dcm4chee-arc-light archive's default listener let a remote sender reassign studies and related workflow records from one patient identity to another. The CPE lists all versions of the product as affected, and the archive's unmerge operation does not reverse the reassignment, so the integrity damage is effectively persistent. No credentials, user interaction, or non-default settings are required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; vendor CVSS 4.0 8.7); the practical limiting factor is network reachability of the HL7/MLLP port, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote peers can query and download patient demographics and medical imagery from dcm4chee-arc-light archives left in their default configuration, because the DICOM listener accepts association requests from calling AE titles that were never registered. An attacker who can reach the archive's DICOM service (commonly TCP 11112) can use C-FIND and C-GET to enumerate and retrieve patient records, and C-STORE to file fabricated studies under an existing patient identity, corrupting the clinical record. Exploitation requires no credentials and no user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N); no public exploit code and no confirmed in-the-wild exploitation are identified at time of analysis, so the high severity is driven by the confidentiality and integrity impact on protected health information rather than by observed attacks.
Remote, unauthenticated attackers can exhaust dcm4chee-arc-light by submitting crafted multipart payloads to its MultipartInputStream parser, which performs inefficient boundary matching and unnecessary buffer copying, driving excessive boundary comparisons and repeated copies that consume CPU and memory until the service slows or becomes unavailable. Every version captured by cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* is affected, and the impact is confined to availability (VC:N/VI:N/VA:H) with no confidentiality or integrity effect. No public exploit identified at time of analysis, but exploitation requires only that a multipart-accepting endpoint such as the DICOMweb STOW-RS upload interface be network-reachable to the attacker; the vendor-classified CVSS 4.0 base of 8.7 (High) matches an independent assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a non-terminating loop that repeatedly reprocesses the same input, consuming CPU and hanging the affected ingestion service. The defect is classified CWE-835 (loop with unreachable exit condition) and is network-reachable and unauthenticated per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so any actor able to reach an archive endpoint that accepts and parses DICOM-encapsulated MP4 media can trigger it; impact is availability-only with no confidentiality or integrity consequence. No public exploit code was identified at time of analysis, and the issue is documented by CISA in ICS medical advisory ICSMA-26-288-02.
JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-encoded stream delivered to the archive's image/DICOM ingestion path, resulting in a denial-of-service condition (CWE-835). Per the supplied CVSS 4.0 vector the flaw is network-reachable and requires no authentication and no user interaction (AV:N, AC:L, PR:N, UI:N), but the impact is availability-only (VA:H with VC:N/VI:N) - no code execution, data disclosure, or integrity loss is described. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded by network reachability: deployments that expose a JPEG/DICOM parsing endpoint beyond a segmented clinical network are the ones materially at risk.
Unauthenticated remote attackers can irreversibly delete stored DICOM objects in dcm4chee-arc-light by invoking the storage status-change REST service and setting a location record that is still associated with existing DICOM instances to the TO_DELETE state, after which the PurgeStorageScheduler background job removes the referenced object from storage while the corresponding instance record remains in the database. This missing authorization flaw (CWE-862) is rated CVSS 8.8 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VI:H/VA:H, VC:N) and allows an attacker to corrupt the integrity and availability of the clinical archive without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Unauthenticated HL7 ADT^A40 patient-merge messages accepted by the dcm4chee-arc-light archive's default listener let a remote sender reassign studies and related workflow records from one patient identity to another. The CPE lists all versions of the product as affected, and the archive's unmerge operation does not reverse the reassignment, so the integrity damage is effectively persistent. No credentials, user interaction, or non-default settings are required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; vendor CVSS 4.0 8.7); the practical limiting factor is network reachability of the HL7/MLLP port, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote peers can query and download patient demographics and medical imagery from dcm4chee-arc-light archives left in their default configuration, because the DICOM listener accepts association requests from calling AE titles that were never registered. An attacker who can reach the archive's DICOM service (commonly TCP 11112) can use C-FIND and C-GET to enumerate and retrieve patient records, and C-STORE to file fabricated studies under an existing patient identity, corrupting the clinical record. Exploitation requires no credentials and no user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N); no public exploit code and no confirmed in-the-wild exploitation are identified at time of analysis, so the high severity is driven by the confidentiality and integrity impact on protected health information rather than by observed attacks.
Remote, unauthenticated attackers can exhaust dcm4chee-arc-light by submitting crafted multipart payloads to its MultipartInputStream parser, which performs inefficient boundary matching and unnecessary buffer copying, driving excessive boundary comparisons and repeated copies that consume CPU and memory until the service slows or becomes unavailable. Every version captured by cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* is affected, and the impact is confined to availability (VC:N/VI:N/VA:H) with no confidentiality or integrity effect. No public exploit identified at time of analysis, but exploitation requires only that a multipart-accepting endpoint such as the DICOMweb STOW-RS upload interface be network-reachable to the attacker; the vendor-classified CVSS 4.0 base of 8.7 (High) matches an independent assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a non-terminating loop that repeatedly reprocesses the same input, consuming CPU and hanging the affected ingestion service. The defect is classified CWE-835 (loop with unreachable exit condition) and is network-reachable and unauthenticated per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so any actor able to reach an archive endpoint that accepts and parses DICOM-encapsulated MP4 media can trigger it; impact is availability-only with no confidentiality or integrity consequence. No public exploit code was identified at time of analysis, and the issue is documented by CISA in ICS medical advisory ICSMA-26-288-02.
JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-encoded stream delivered to the archive's image/DICOM ingestion path, resulting in a denial-of-service condition (CWE-835). Per the supplied CVSS 4.0 vector the flaw is network-reachable and requires no authentication and no user interaction (AV:N, AC:L, PR:N, UI:N), but the impact is availability-only (VA:H with VC:N/VI:N) - no code execution, data disclosure, or integrity loss is described. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded by network reachability: deployments that expose a JPEG/DICOM parsing endpoint beyond a segmented clinical network are the ones materially at risk.
Unauthenticated remote attackers can irreversibly delete stored DICOM objects in dcm4chee-arc-light by invoking the storage status-change REST service and setting a location record that is still associated with existing DICOM instances to the TO_DELETE state, after which the PurgeStorageScheduler background job removes the referenced object from storage while the corresponding instance record remains in the database. This missing authorization flaw (CWE-862) is rated CVSS 8.8 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VI:H/VA:H, VC:N) and allows an attacker to corrupt the integrity and availability of the clinical archive without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).