{"id":"CVE-2026-105273","kind":"vulnerability","aliases":["CVE-2026-105273"],"related":[],"title":"MP4Parser: malformed box sizes cause endless parsing loop","description":"MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.","summary":"The MP4Parser component of J4Care dcm4chee-arc-light (DICOM medical image archive) does not validate MP4 box sizes. A malformed box makes parsing loop without progress, so a remote unauthenticated attacker can cause denial of service (CWE-835). CISA CVSS v3.1 7.5, v4.0 8.7. Same CISA advisory covers five sibling CVEs in the same release.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dcm4chee-arc-light","fixed":["5.35.2"],"affected":"5.35.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["dcm4chee","dcm4chee-arc-light","denial-of-service","dicom","healthcare","j4care","media-processing","mp4parser","package","self-hosted"],"not_affected_if":["no-untrusted-mp4-input"],"how_to_check":"Check the running dcm4chee-arc-light version (archive UI/about page or deployed package version). Version 5.35.1 is affected; earlier versions are not stated in the advisory (unknown).","fix":"Upgrade dcm4chee-arc-light to 5.35.2 or later. Meanwhile, keep the archive off the internet and behind a firewall, per CISA.","status":"open","published_at":"2026-10-16T15:17:03+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:08+00:00","updated_at":"2026-10-24T00:27:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:39:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"MP4Parser: malformed box sizes cause endless parsing loop","impact":"low","summary":"MP4Parser fails to validate MP4 box sizes, so a crafted file makes parsing repeat the same input without progress. An attacker can use this to stall or exhaust the process that parses untrusted MP4 files.","category":"package","who_cares":["mp4parser","media-processing"],"confidence":0.5,"needs_auth":"unknown","worst_case":"parser hangs or denial of service on crafted MP4 input","analyst_note":"Find the affected MP4Parser package, versions, and patched release at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-105273 and the upstream advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-mp4-input"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000461,"input_tokens":2845,"output_tokens":352,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected MP4Parser package, versions, and patched release at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-105273 and the upstream advisory.","search":"'-105273':11A,14A '-2026':10A,13A '-835':77B '7.5':81B '8.7':83B 'adequ':98C 'advisori':86B 'arc':17A,22B,46B 'archiv':51B 'attack':70B 'box':3A,56B,60B,101C,105C 'caus':5A,72B,107C 'cisa':78B,85B 'compon':41B 'cover':87B 'cve':9A,12A 'cves':90B 'cvss':79B 'cwe':76B 'dcm4chee':16A,19B,21B,45B 'dcm4chee-arc-light':15A,20B,44B 'denial':25B,73B 'denial-of-servic':24B 'dicom':28B,48B 'endless':6A 'five':88B 'forward':112C 'healthcar':29B 'host':38B 'imag':50B 'input':119C 'j4care':30B,43B 'light':18A,23B,47B 'loop':8A,63B 'make':61B,110C 'malform':2A,59B,104C 'media':32B 'media-process':31B 'medic':49B 'mp4':55B,100C 'mp4parser':1A,34B,40B,95C 'packag':35B 'pars':7A,62B,108C 'process':33B,116C 'progress':65B,113C 'releas':94B 'remot':68B 'repeat':115C 'self':37B 'self-host':36B 'servic':27B,75B 'sibl':89B 'size':4A,57B,102C 'unauthent':69B 'v3.1':80B 'v4.0':82B 'valid':54B,99C 'without':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105273","severity":null,"published_at":"2026-10-16T15:17:03+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105273:665","url":null,"severity":null,"published_at":"2026-10-24T00:27:46+00:00","modified_at":"2026-10-24T00:27:46+00:00","first_seen_at":"2026-10-24T00:27:46+00:00","fetched_at":"2026-10-24T00:27:46+00:00","note":"CISA ICSMA-26-288-02 (primary found via NVD): MP4Parser is a component of J4Care dcm4chee-arc-light 5.35.1; fixed in 5.35.2. No exploitation reported to CISA; no PoC found; no community posts searched (niche, no CVE-named conversation in web results). Exact affected range below 5.35.1 unknown; advisory lists only 5.35.1."}],"documents":[{"id":2029,"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","title":"CISA ICSMA-26-288-02 J4Care dcm4che","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2626,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105273","title":"NVD CVE-2026-105273","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}