J4Care dcm4che

CISA has published an ICS medical advisory (ICSMA-26-288-02) detailing six vulnerabilities in J4Care dcm4chee-arc-light version 5.35.1, a medical imaging archive platform used worldwide in healthcare. The vulnerabilities include Missing Authorization (CVE-2026-97851), two Infinite Loop issues in JPEG and MP4 parsers (CVE-2026-107621, CVE-2026-105273), Inefficient Algorithmic Complexity in multipart stream handling (CVE-2026-101021), and two Missing Authentication for Critical Function flaws affecting DICOM associations and HL7 listener (CVE-2026-105279, CVE-2026-105667). Successful exploitation could allow attackers to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause denial-of-service. The highest CVSS v3.1 score is 9.1 (Critical), with some CVEs reaching 9.3 under CVSS v4.0. J4Care has released version 5.35.2 as the fix. These vulnerabilities were reported by Abhinav Agarwal to CISA, and no known active exploitation has been reported at the time of publication.