Is CVE-2026-105273 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105273 being exploited in the wild.

How severe is CVE-2026-105273?

High severity, with a CVSS score of 7.5, published 16 October 2026.

Which products and versions are affected?

J4Care Dcm4chee-Arc-Light 5.35.1.

Is there a fix for CVE-2026-105273?

Yes: fixed in 5.35.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105273 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105273?

Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105273: J4Care dcm4chee-arc-light MP4Parser infinite loop in MP4 box parsing

CVE-2026-105273 · Severity: high · CVSS 7.5 · Published 2026-10-16

J4Care dcm4chee-arc-light is a medical imaging archive used in healthcare systems to store and manage DICOM patient images. The MP4Parser component fails to validate box sizes in MP4 files, allowing a malformed MP4 file to cause the parser to enter an infinite loop that repeatedly processes the same data without making progress. An attacker could upload a crafted MP4 file to cause a denial-of-service condition that disrupts medical imaging services.

Technologies: J4Care Dcm4chee-Arc-Light. Vendors: J4Care.

Quick answers

Is CVE-2026-105273 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105273 being exploited in the wild.
How severe is CVE-2026-105273?: High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?: J4Care Dcm4chee-Arc-Light 5.35.1.
Is there a fix for CVE-2026-105273?: Yes: fixed in 5.35.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105273 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105273?: Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.35.2 or later

Technical details

The MP4Parser in dcm4chee-arc-light lacks adequate validation of MP4 box sizes, allowing a specially crafted malformed box to create a loop with no forward progress (CWE-835). The vulnerability requires network access to send the malicious MP4 file but no authentication or user interaction; successful exploitation causes denial of service through resource exhaustion. A fix is available in release 5.35.2 or later.

Affected products

J4Care dcm4chee-arc-light 5.35.1

Timeline

2026-10-15: disclosed
2026-10-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.