Loading story…
Several high-severity vulnerabilities have been disclosed in the OFFIS DCMTK Toolkit, a widely used DICOM implementation for medical imaging workflows, including a critical path traversal flaw tracked as CVE-2026-50003. That issue allows a malicious or compromised server to make a DCMTK client using bit-preserving C-GET storage mode write files outside the intended output directory via relative ../ or absolute paths. Another path traversal bug, CVE-2026-52868, lets an unauthenticated remote attacker read worklist records from directories outside the intended per-AE worklist storage area, potentially exposing sensitive patient or departmental data across organizational boundaries in multi-area deployments.
Additional remotely exploitable flaws can also disrupt DCMTK services. CVE-2026-50254 and CVE-2026-35505 are memory-leak issues that allow repeated crafted connection requests to exhaust memory and crash single-process deployments such as storescp, while CVE-2026-44628 is a type confusion vulnerability that can crash the worklist server with a single crafted query under specific conditions. Reported severity ranges up to CVSS 9.8 under v3.1 and 9.3 under v4.0, and recommended mitigations include updating DCMTK, validating and sanitizing file paths and inputs, restricting worklist storage access, using stronger access controls, and considering multi-process operation to reduce denial-of-service impact.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic published an advisory for Fleet Server versions 8.19.11, 9.2.5, and 9.3.0 titled ESA-2026-44. The provided reference confirms the advisory's publication but does not include further technical details in the synopsis.
Five remotely exploitable vulnerabilities affecting the OFFIS DCMTK Toolkit were published: CVE-2026-52868, CVE-2026-50254, CVE-2026-50003, CVE-2026-44628, and CVE-2026-35505. The issues include path traversal, memory leak denial of service, and type confusion flaws, with recommended mitigations centered on updating, input validation, and access restrictions.
On the oss-sec mailing list, five vulnerabilities affecting OFFIS DCMTK 3.7.0 and earlier were disclosed as part of CISA advisory ICSMA-26-181-01 and CERT/CC case VU#470252. The post said fixes had been committed to the upstream master branch but were not yet included in a released version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
8 references tracked. Mallory keeps watching after this page renders.
discuss.elastic.co
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecisa.gov
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued an advisory for **CVE-2026-3650**, a high-severity denial-of-service vulnerability in **Grassroots DICOM (GDCM) 3.2.2)**, a C++ library used to process DICOM medical images in healthcare environments. The flaw is a **memory leak** (`CWE-401`) triggered when the library parses malformed DICOM files containing non-standard VR types in file meta information, leading to excessive memory allocation, heap exhaustion, and potential service disruption from a single read operation. The issue carries a **CVSS v3.1 score of 7.5** with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`. Researchers **Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS** reported the vulnerability to CISA. The agency said the bug could be exploited remotely by sending a specially crafted file and warned that affected organizations in the **healthcare and public health sector worldwide** may be exposed if they rely on the library. CISA reported no known public exploitation at publication time, but said **no patch is currently available** and that the maintainer did not respond to mitigation requests; in the meantime, it recommended reducing exposure by keeping affected systems off the public internet, segmenting networks behind firewalls, and securing remote access with up-to-date VPNs.
Jun 29, 2026
A high-severity server-side request forgery flaw in **OHIF DICOM Web Viewer Framework** tracked as `CVE-2026-12473` could let attackers steal authenticated clinicians’ OIDC bearer tokens by luring them to open a crafted link. The issue affects versions prior to **3.12.0** and stems from the default **DICOMWebProxy** and **DICOMJSON** data sources accepting arbitrary URL parameters without validation, while OHIF’s global authentication service may automatically attach the user’s bearer token to outbound requests sent to attacker-controlled infrastructure. The flaw does **not** affect DICOMweb data sources. The vulnerability carries high-severity ratings of **CVSS 4.0 8.3** and **CVSS 3.1 8.2**, and remediation guidance urges organizations to upgrade to the fixed release **3.12.2**, disable unnecessary DICOMWebProxy and DICOMJSON data sources, validate all URL parameters, block arbitrary URL fetching, and restrict OIDC token injection to trusted hosts. Public reporting and advisory material indicate the bug is remotely exploitable and particularly relevant to authenticated healthcare imaging deployments where token exposure could enable unauthorized access.
Jun 29, 2026
Multiple newly disclosed vulnerabilities exposed **arbitrary file write** paths through symlink handling and path validation failures in developer and server-side software. In **Crawl4AI** before `0.8.8`, `CVE-2026-56258` affects screenshot and PDF endpoints by combining weak `output_path` validation, symlink following, and a **TOCTOU** race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In **Cursor Desktop** before `3.0`, `CVE-2026-50549` lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution. A related pattern also appeared in archive extraction and privileged upload handling. The **extract-zip** package is affected by `CVE-2026-56876`, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, **pwnlift** disclosed `CVE-2026-56815` in a privileged upload handler that could be abused for arbitrary file write **as root** through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged `sudo` entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Jul 2, 2026