CISA Warns of Critical Vulnerabilities in J4Care dcm4chee-arc-light Affecting Healthcare Systems
CISA has issued an advisory for multiple critical vulnerabilities in J4Care dcm4chee-arc-light, potentially allowing attackers to delete medical images, disclose patient data, or cause denial-of-service conditions.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a critical advisory detailing several severe vulnerabilities within J4Care's dcm4chee-arc-light software, a widely deployed solution in healthcare systems globally. The identified flaws, primarily affecting versions prior to 5.35.2, pose significant risks to patient data confidentiality, integrity, and system availability.
Exploitation of these vulnerabilities could grant attackers the ability to delete stored medical images, leading to the loss of critical diagnostic information. Furthermore, attackers could potentially disclose sensitive patient information, inject forged medical studies into patient records, reassign patient records to unauthorized individuals, overwrite critical files, or induce denial-of-service (DoS) conditions, rendering healthcare systems inoperable.
Several specific vulnerabilities have been highlighted. CVE-2026-97851, rated with a CVSS v3.1 score of 9.1 (Critical), involves a missing authorization flaw in the storage status-change REST service. This allows an attacker to change location records associated with DICOM instances to a deletion state, causing the system to purge objects from storage while leaving corresponding database records intact, potentially leading to data loss.
Another critical vulnerability, CVE-2026-107621 (CVSS v3.1 score of 7.5, High), stems from an infinite loop within the JPEGParser component. When parsing a specially crafted or truncated stream, the parser can enter a loop that never terminates, leading to a denial-of-service condition. Similarly, CVE-2026-105273, also rated 7.5 (High), involves inadequate validation of MP4 box sizes by the MP4Parser, which can cause parsing to stall and repeatedly process the same input, resulting in a DoS.
CVE-2026-101021, with a CVSS v3.1 score of 7.5 (High), relates to inefficient algorithmic complexity in the MultipartInputStream. Crafted multipart input can force excessive boundary comparisons and buffer copying, consuming excessive system resources and potentially leading to a DoS.
Additionally, CVE-2026-105279, rated 7.5 (High), exploits a default configuration that accepts DICOM associations from unregistered calling AE entities. This allows remote attackers to enumerate and retrieve patient information and medical images using C-FIND and C-GET, or to file fabricated study content under existing patient identities via C-STORE.
J4Care has addressed these vulnerabilities by releasing version 5.35.2 of dcm4chee-arc-light. The company strongly recommends that all users upgrade to this latest version or a subsequent release to mitigate the identified risks. The widespread deployment of this software in the global healthcare sector underscores the urgency of applying these patches to protect patient data and maintain the operational integrity of critical medical infrastructure.
The advisory also lists multiple Common Weakness Enumerations (CWEs) associated with these vulnerabilities, including CWE-862 (Missing Authorization), CWE-835 (Loop with Unreachable Exit Condition), and CWE-407 (Inefficient Algorithmic Complexity), further detailing the nature of the security weaknesses.