Loading story…
A high-severity server-side request forgery flaw in OHIF DICOM Web Viewer Framework tracked as CVE-2026-12473 could let attackers steal authenticated clinicians’ OIDC bearer tokens by luring them to open a crafted link. The issue affects versions prior to 3.12.0 and stems from the default DICOMWebProxy and DICOMJSON data sources accepting arbitrary URL parameters without validation, while OHIF’s global authentication service may automatically attach the user’s bearer token to outbound requests sent to attacker-controlled infrastructure. The flaw does not affect DICOMweb data sources.
The vulnerability carries high-severity ratings of CVSS 4.0 8.3 and CVSS 3.1 8.2, and remediation guidance urges organizations to upgrade to the fixed release 3.12.2, disable unnecessary DICOMWebProxy and DICOMJSON data sources, validate all URL parameters, block arbitrary URL fetching, and restrict OIDC token injection to trusted hosts. Public reporting and advisory material indicate the bug is remotely exploitable and particularly relevant to authenticated healthcare imaging deployments where token exposure could enable unauthorized access.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-12975 was published as a high-severity Apicurio Registry vulnerability caused by insecure XML parsing in ContentTypeUtil.isParsableXml(). The flaw can enable blind XXE-driven SSRF and denial of service through entity expansion, with Red Hat listed as the source.
CVE-2026-12473 was published as a high-severity SSRF vulnerability in OHIF Viewers, with guidance to disable unnecessary DICOMWebProxy and DICOMJSON data sources, validate URL parameters, and restrict OIDC token injection to trusted hosts. The issue was described as remotely exploitable and sourced to ICS-CERT.
The OHIF maintainer fixed the server-side request forgery issue affecting OHIF DICOM Web Viewer Framework by releasing version 3.12.2. The flaw could cause an authenticated clinician’s OIDC bearer token to be sent to an attacker-controlled server via default DICOMWebProxy and DICOMJSON data sources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued an advisory for **CVE-2026-3650**, a high-severity denial-of-service vulnerability in **Grassroots DICOM (GDCM) 3.2.2)**, a C++ library used to process DICOM medical images in healthcare environments. The flaw is a **memory leak** (`CWE-401`) triggered when the library parses malformed DICOM files containing non-standard VR types in file meta information, leading to excessive memory allocation, heap exhaustion, and potential service disruption from a single read operation. The issue carries a **CVSS v3.1 score of 7.5** with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`. Researchers **Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS** reported the vulnerability to CISA. The agency said the bug could be exploited remotely by sending a specially crafted file and warned that affected organizations in the **healthcare and public health sector worldwide** may be exposed if they rely on the library. CISA reported no known public exploitation at publication time, but said **no patch is currently available** and that the maintainer did not respond to mitigation requests; in the meantime, it recommended reducing exposure by keeping affected systems off the public internet, segmenting networks behind firewalls, and securing remote access with up-to-date VPNs.
Jun 29, 2026
Several high-severity vulnerabilities have been disclosed in the **OFFIS DCMTK Toolkit**, a widely used DICOM implementation for medical imaging workflows, including a critical path traversal flaw tracked as `CVE-2026-50003`. That issue allows a malicious or compromised server to make a DCMTK client using bit-preserving `C-GET` storage mode write files outside the intended output directory via relative `../` or absolute paths. Another path traversal bug, `CVE-2026-52868`, lets an unauthenticated remote attacker read worklist records from directories outside the intended per-AE worklist storage area, potentially exposing sensitive patient or departmental data across organizational boundaries in multi-area deployments. Additional remotely exploitable flaws can also disrupt DCMTK services. `CVE-2026-50254` and `CVE-2026-35505` are memory-leak issues that allow repeated crafted connection requests to exhaust memory and crash single-process deployments such as `storescp`, while `CVE-2026-44628` is a type confusion vulnerability that can crash the worklist server with a single crafted query under specific conditions. Reported severity ranges up to **CVSS 9.8** under v3.1 and **9.3** under v4.0, and recommended mitigations include updating DCMTK, validating and sanitizing file paths and inputs, restricting worklist storage access, using stronger access controls, and considering multi-process operation to reduce denial-of-service impact.
Jul 1, 2026
A critical argument injection vulnerability, tracked as CVE-2025-12556, was identified in the *IDIS ICM Viewer* software. This flaw allows remote attackers to execute arbitrary code on affected systems by exploiting improper neutralization of argument delimiters in command execution. The vulnerability is rated with a CVSS v3.1 base score of 8.8 and a CVSS v4 score of 8.7, indicating high severity and significant risk to organizations using the affected product. The vulnerability specifically impacts *ICM Viewer* version v1.6.0.10, and exploitation could compromise the host machine's security. IDIS has responded by requiring all users to upgrade to version v1.7.1 to mitigate the risk, warning that failure to update will render the software unusable. CISA has also issued an advisory urging immediate action, including uninstalling the program if it is not in use, to prevent potential exploitation in critical infrastructure environments worldwide.
Jul 12, 2026