CISA spent the summer working through the DICOM stack

MedDevice Cyber Staff · 6 days ago · 4 min read · Via CISA

Shawn Day / Unsplash

Four ICS medical advisories this year target open source DICOM components. GDCM (ICSMA-26-083-01). pydicom and pynetdicom (ICSMA-26-176-01). The OHIF viewer framework (ICSMA-26-176-02). OFFIS DCMTK (ICSMA-26-181-01).

Study the OHIF one. CVE-2026-12473, CVSS 8.2. Two default data sources fetch an arbitrary URL without validation, and the auth layer injects the user’s OIDC bearer token into requests to whatever server an attacker names. Token theft by crafted link. Fixed in 3.12.2. Credit to Simon Weber and Volker Schönefeld of Machine Spirits UG. DCMTK adds a path traversal, CVE-2026-50003.

If you build or buy imaging, these libraries are in your SBOM whether you know it or not. Philips put out its own DCMTK advisory on July 8. That’s the downstream obligation in action: assess, disclose, patch, even when the bug was never yours.

Component intake is the job now. A CISA advisory on an open source library is the starting gun for yours. Makers with working intake pipelines publish while everyone else is still grepping SBOMs.

Remediation Desk

The advisories landed in shared imaging libraries, not in one vendor product, so the fix is an SBOM exercise. Map GDCM, pydicom, OHIF and DCMTK to every product that embeds them, then patch or pin to fixed versions and re-issue the affected builds.

Resolve the libraries in your SBOM. Find every product that bundles GDCM, pydicom, OHIF or DCMTK, including transitive dependencies you did not add directly.
Patch to fixed upstream versions. Track each advisory to the upstream fix commit and rebuild affected products against it.
Subscribe to upstream security feeds. The imaging plumbing is maintained elsewhere, so watch the upstream projects, not just your own code, for the next advisory.

← Back to Vulnerabilities

CISA spent the summer working through the DICOM stack

More Vulnerabilities