Loading story…
CISA issued an advisory for CVE-2026-3650, a high-severity denial-of-service vulnerability in Grassroots DICOM (GDCM) 3.2.2), a C++ library used to process DICOM medical images in healthcare environments. The flaw is a memory leak (CWE-401) triggered when the library parses malformed DICOM files containing non-standard VR types in file meta information, leading to excessive memory allocation, heap exhaustion, and potential service disruption from a single read operation. The issue carries a CVSS v3.1 score of 7.5 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Researchers Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS reported the vulnerability to CISA. The agency said the bug could be exploited remotely by sending a specially crafted file and warned that affected organizations in the healthcare and public health sector worldwide may be exposed if they rely on the library. CISA reported no known public exploitation at publication time, but said no patch is currently available and that the maintainer did not respond to mitigation requests; in the meantime, it recommended reducing exposure by keeping affected systems off the public internet, segmenting networks behind firewalls, and securing remote access with up-to-date VPNs.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Following disclosure, CISA advised organizations using Grassroots DICOM to reduce exposure by avoiding internet-facing deployment, isolating control system networks behind firewalls, and using secure updated VPNs for remote access. Reporting indicated that no patch was available at the time.
CISA published ICS advisory ICSMA-26-083-01 describing CVE-2026-3650, a high-severity denial-of-service vulnerability in Grassroots DICOM 3.2.2 with a CVSS v3.1 score of 7.5. CISA said exploitation could cause excessive memory allocation and heap exhaustion, noted no known public exploitation, and stated the maintainer had not responded to mitigation requests.
Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS discovered a memory-leak denial-of-service vulnerability in Grassroots DICOM (GDCM) 3.2.2 and reported it to CISA. The flaw, later tracked as CVE-2026-3650, can be triggered by parsing malformed DICOM files with non-standard VR types in file meta information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcecvefeed.io
Open sourcehipaajournal.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity server-side request forgery flaw in **OHIF DICOM Web Viewer Framework** tracked as `CVE-2026-12473` could let attackers steal authenticated clinicians’ OIDC bearer tokens by luring them to open a crafted link. The issue affects versions prior to **3.12.0** and stems from the default **DICOMWebProxy** and **DICOMJSON** data sources accepting arbitrary URL parameters without validation, while OHIF’s global authentication service may automatically attach the user’s bearer token to outbound requests sent to attacker-controlled infrastructure. The flaw does **not** affect DICOMweb data sources. The vulnerability carries high-severity ratings of **CVSS 4.0 8.3** and **CVSS 3.1 8.2**, and remediation guidance urges organizations to upgrade to the fixed release **3.12.2**, disable unnecessary DICOMWebProxy and DICOMJSON data sources, validate all URL parameters, block arbitrary URL fetching, and restrict OIDC token injection to trusted hosts. Public reporting and advisory material indicate the bug is remotely exploitable and particularly relevant to authenticated healthcare imaging deployments where token exposure could enable unauthorized access.
Jun 29, 2026
Several high-severity vulnerabilities have been disclosed in the **OFFIS DCMTK Toolkit**, a widely used DICOM implementation for medical imaging workflows, including a critical path traversal flaw tracked as `CVE-2026-50003`. That issue allows a malicious or compromised server to make a DCMTK client using bit-preserving `C-GET` storage mode write files outside the intended output directory via relative `../` or absolute paths. Another path traversal bug, `CVE-2026-52868`, lets an unauthenticated remote attacker read worklist records from directories outside the intended per-AE worklist storage area, potentially exposing sensitive patient or departmental data across organizational boundaries in multi-area deployments. Additional remotely exploitable flaws can also disrupt DCMTK services. `CVE-2026-50254` and `CVE-2026-35505` are memory-leak issues that allow repeated crafted connection requests to exhaust memory and crash single-process deployments such as `storescp`, while `CVE-2026-44628` is a type confusion vulnerability that can crash the worklist server with a single crafted query under specific conditions. Reported severity ranges up to **CVSS 9.8** under v3.1 and **9.3** under v4.0, and recommended mitigations include updating DCMTK, validating and sanitizing file paths and inputs, restricting worklist storage access, using stronger access controls, and considering multi-process operation to reduce denial-of-service impact.
Jul 1, 2026
A high-severity vulnerability, tracked as CVE-2024-22774, was discovered in the AJAT Panoramic Dental Imaging Software SDK, now owned by Varex Imaging. The flaw, caused by an uncontrolled search path element (CWE-427), allows for DLL hijacking, enabling a standard user to escalate privileges and obtain NT Authority/SYSTEM access via the `ccsservice.exe` component. The vulnerability affects software versions prior to 6.6.1.490 and was identified by security researcher Damian Semon Jr. of Blue Team Alpha Inc. Both the vendor and the Cybersecurity and Infrastructure Security Agency (CISA) have issued advisories, rating the issue as high-severity with a CVSS v4 base score of 8.5 and a CVSS v3.1 score of 7.8. Varex Imaging has released a patch to address the vulnerability and strongly advises all users to update their systems by running the installation executable on each affected workstation. CISA further recommends placing the software behind a firewall, restricting Internet access, and using secure remote access methods such as up-to-date VPNs. The vulnerability is particularly relevant to the healthcare and public health sectors, with deployments primarily in North America. Organizations using the affected software should prioritize patching to mitigate the risk of privilege escalation attacks.
Jun 29, 2026