Live › vulnerability › CVE-2026-105273
Go to dashboardThe MP4Parser component of J4Care dcm4chee-arc-light (DICOM medical image archive) does not validate MP4 box sizes. A malformed box makes parsing loop without progress, so a remote unauthenticated attacker can cause denial of service (CWE-835). CISA CVSS v3.1 7.5, v4.0 8.7. Same CISA advisory covers five sibling CVEs in the same release.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| dcm4chee-arc-light | vendor | 5.35.1 | 5.35.2 |
5.35.1 is affected; earlier versions are not stated in the advisory (unknown)5.35.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.
This page as .md · .json · in your agent: get_signal("CVE-2026-105273")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.