CISA worked through the open-source DICOM stack all year

MedDevice Cyber Staff · Jun 30 · 4 min read · Via CISA ICSMA-26-176-02 (OHIF viewer)

Four medical advisories this year hit open-source DICOM components. GDCM in March (ICSMA-26-083-01). pydicom and pynetdicom in June (ICSMA-26-176-01). The OHIF viewer the same week (ICSMA-26-176-02). OFFIS DCMTK at the end of June (ICSMA-26-181-01), five CVEs including a path traversal at 9.8.

Study the OHIF one. CVE-2026-12473, base score 8.2. Two default data sources fetch an arbitrary URL without validation, and the auth layer injects the user OIDC bearer token into requests aimed at whatever server an attacker names. Token theft by crafted link. Fixed in 3.12.2, credit to Simon Weber and Volker Schoenefeld of Machine Spirits UG.

An embedded library disappears into the product that ships it. Once compiled in it carries no branding and rarely surfaces in the interface, so the teams running the finished device may not know it is there. A flaw in the upstream project becomes a flaw in every downstream product that absorbed the code.

None of these are products. They are libraries embedded in products, probably including yours. Philips published its own DCMTK advisory in July, which is the downstream obligation: assess, disclose, patch, even when the bug was never your code.

The imaging ecosystem magnifies the effect, because a handful of open-source projects underpin much of the software that reads and moves medical images. The same decoder or networking code sits inside viewers and archives from many vendors, so one upstream defect radiates across products that otherwise share nothing.

For the hospital at the end of the chain, the abstraction collapses into ordinary risk. A viewer steered to an attacker's server, or a token lifted through a crafted link, means images and identities leaving by a channel the clinical staff never see. Those reading studies cannot audit the libraries under their tools, and inherit whatever the code does.

Component intake is the job now. A CISA advisory on an upstream library is the starting gun for your own, and the makers with working SBOM pipelines will publish while everyone else is still searching for where the library even lives.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

GDCM, pydicom, OHIF and DCMTK each drew advisories in 2026, and they sit inside commercial products as dependencies, so this is an SBOM problem. Identify every product that embeds them, patch to fixed versions, and monitor the upstream projects going forward.

Map the dependencies. List every product that bundles these four libraries, including copies pulled in transitively.
Patch and rebuild. Update each embed to the fixed upstream release and re-issue the affected product builds.
Watch upstream continuously. These libraries are maintained outside your codebase, so subscribe to their advisories and fold them into your vulnerability process.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

parse_image

Contributing

sys_ots_software net_wireless net_wired net_cloud app_web_ui app_user_accounts app_file_upload data_phi use_hospital_net net_remote_access

EMB3D

PID-23 PID-26

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which DICOM libraries drew CISA advisories in 2026?

GDCM (ICSMA-26-083-01), pydicom and pynetdicom (ICSMA-26-176-01), the OHIF viewer (ICSMA-26-176-02) and OFFIS DCMTK (ICSMA-26-181-01), the last with five CVEs including a 9.8 path traversal.

What is CVE-2026-12473 in the OHIF viewer?

Two default data sources fetch an arbitrary URL without validation, and the auth layer injects the user’s OIDC bearer token into requests aimed at whatever server an attacker names. Token theft by crafted link, base score 8.2, fixed in 3.12.2.

What should manufacturers do about library advisories?

Treat an upstream advisory as the starting gun for your own: assess, disclose and patch, the way Philips published its own DCMTK advisory in July. A working SBOM pipeline is what makes that fast.

← Back to Vulnerabilities