J4Care dcm4chee-arc-light: Infinite loop in MP4 parser
Summary
J4Care dcm4chee-arc-light, a DICOM archive server for medical imaging, contains an MP4 parser that does not properly validate MP4 box sizes. A malformed MP4 box can keep the parser from making forward progress, so it repeatedly processes the same input. According to the CVE record, an attacker can exploit this over the network without authentication or user interaction, with an availability impact (denial of service); CISA rates the impact higher, including confidentiality and integrity.
Affected
- dcm4chee-arc-light 5.35.1 (per CISA advisory ICSMA-26-288-02)
- Earlier versions: Unknown.
Fixed in
- dcm4chee-arc-light 5.35.2 or later (J4Care recommendation)
Workaround
Unknown. No vendor workaround is documented in the sources. Restrict network access to the archive until it is upgraded.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- VulDB: no available exploit.
- EPSS is very low (about 0.003, third-party data).
Our recommendation
- Upgrade dcm4chee-arc-light to version 5.35.2 or later.
- If an upgrade cannot be done immediately, restrict DICOM and web interfaces to trusted networks and do not expose them to the internet.
- Check whether the archive is reachable from guest or untrusted networks and prioritise accordingly.
- Monitor for hung processes, high CPU usage and resource exhaustion on the archive server.
- If the system is a medical device or under manufacturer support, coordinate the upgrade with the manufacturer or integrator.
- Note that CVSS 4.0 scores differ (8.7 in the CVE record, 9.3 in CISA's advisory); plan for the higher rating.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Medical Advisory ICSMA-26-288-02 www.cisa.gov
- CISA CSAF file ICSMA-26-288-02 github.com
- VulDB entry 421298 vuldb.com
- SecurityFocus CVE-2026-105273 www.securityfocus.com
- Threatint CVE-2026-105273 cve.threatint.com
- Vulners VulnCheck/EPSS CVE-2026-105273 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:21.
Original description (NVD)
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.