CISA worked through the open-source DICOM stack all year

MedDevice Cyber Staff · Jun 30 · 4 min read · Via CISA ICSMA-26-176-02 (OHIF viewer)

CDC / Unsplash

Four medical advisories this year hit open-source DICOM components. GDCM in March (ICSMA-26-083-01). pydicom and pynetdicom in June (ICSMA-26-176-01). The OHIF viewer the same week (ICSMA-26-176-02). OFFIS DCMTK at the end of June (ICSMA-26-181-01), five CVEs including a path traversal at 9.8.

Study the OHIF one. CVE-2026-12473, base score 8.2. Two default data sources fetch an arbitrary URL without validation, and the auth layer injects the user OIDC bearer token into requests aimed at whatever server an attacker names. Token theft by crafted link. Fixed in 3.12.2, credit to Simon Weber and Volker Schoenefeld of Machine Spirits UG.

None of these are products. They are libraries embedded in products, probably including yours. Philips published its own DCMTK advisory in July, which is the downstream obligation: assess, disclose, patch, even when the bug was never your code.

Component intake is the job now. A CISA advisory on an upstream library is the starting gun for your own, and the makers with working SBOM pipelines will publish while everyone else is still searching for where the library even lives.

Remediation Desk

GDCM, pydicom, OHIF and DCMTK each drew advisories in 2026, and they sit inside commercial products as dependencies, so this is an SBOM problem. Identify every product that embeds them, patch to fixed versions, and monitor the upstream projects going forward.

Map the dependencies. List every product that bundles these four libraries, including copies pulled in transitively.
Patch and rebuild. Update each embed to the fixed upstream release and re-issue the affected product builds.
Watch upstream continuously. These libraries are maintained outside your codebase, so subscribe to their advisories and fold them into your vulnerability process.

Questions & Answers

Which DICOM libraries drew CISA advisories in 2026?

GDCM (ICSMA-26-083-01), pydicom and pynetdicom (ICSMA-26-176-01), the OHIF viewer (ICSMA-26-176-02) and OFFIS DCMTK (ICSMA-26-181-01), the last with five CVEs including a 9.8 path traversal.

What is CVE-2026-12473 in the OHIF viewer?

Two default data sources fetch an arbitrary URL without validation, and the auth layer injects the user’s OIDC bearer token into requests aimed at whatever server an attacker names. Token theft by crafted link, base score 8.2, fixed in 3.12.2.

What should manufacturers do about library advisories?

Treat an upstream advisory as the starting gun for your own: assess, disclose and patch, the way Philips published its own DCMTK advisory in July. A working SBOM pipeline is what makes that fast.

← Back to Vulnerabilities