Vulnerability

Philips lists CT scanners and Advanced Visualization Workspace as exposed to OFFIS DCMTK flaws

MedDevice Cyber Staff · Jul 8 · 2 min read · Via Philips security advisory

Philips published a security notice on July 8, 2026 listing five of its imaging products as exposed to vulnerabilities in OFFIS DCMTK, the open-source DICOM toolkit, after a CISA advisory on the library. The named products are Advanced Visualization Workspace (881001) V15 and V16, Incisive CT 4.5 and Incisive 5.0, CT 3500, Access CT and MX16.

Philips says successful exploitation could expose patient information, disrupt DICOM storage or worklist services, exhaust service memory, crash imaging services, and cause DCMTK-based clients to write files outside the intended output directory.

The notice states that Philips is monitoring the issue; it names no fixed version. DCMTK sits under a long tail of imaging software, which is exactly where an SBOM pays for itself: a scanner fleet that cannot answer which builds carry the library is guessing.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips has not named a fixed version in the notice; it is monitoring the CISA advisory on OFFIS DCMTK. Operators of the listed CT scanners and Advanced Visualization Workspace should contact Philips service for patch availability and restrict DICOM services to known peers in the meantime.

Inventory the listed systems. Find every Advanced Visualization Workspace V15 and V16, Incisive CT, CT 3500, Access CT and MX16 on the network.
Restrict DICOM peers. Allow DICOM storage and worklist traffic only from known modalities and archives.
Track the Philips advisory. Apply Philips-authorized updates when the company publishes them through service.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

DICOM or image parsing

Contributing

Handles patient data Off-the-shelf software Hospital network

Advanced Visualization Workspace

DICOM or image parsing Handles patient data

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by the OFFIS DCMTK vulnerabilities?

In a July 8, 2026 notice Philips listed Advanced Visualization Workspace V15 and V16, Incisive CT 4.5 and Incisive 5.0, CT 3500, Access CT and MX16 as affected by OFFIS DCMTK vulnerabilities.

What can an attacker do through the DCMTK flaws on Philips imaging systems?

Philips says exploitation could expose patient information, disrupt DICOM storage or worklist services, exhaust memory, crash imaging services and cause DCMTK-based clients to write files outside the intended output directory.

← Back to Vulnerabilities