# CVE-2026-105273: J4Care dcm4chee-arc-light MP4Parser infinite loop in MP4 box parsing

Source: https://junglewise.ai/threats/cve-2026-105273-mp4parser-does-not-adequately-validate-mp4-box-sizes-a-malformed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105273 · Severity: high · CVSS 7.5 · Published 2026-10-16

J4Care dcm4chee-arc-light is a medical imaging archive used in healthcare systems to store and manage DICOM patient images. The MP4Parser component fails to validate box sizes in MP4 files, allowing a malformed MP4 file to cause the parser to enter an infinite loop that repeatedly processes the same data without making progress. An attacker could upload a crafted MP4 file to cause a denial-of-service condition that disrupts medical imaging services.

Technologies: [J4Care Dcm4chee-Arc-Light](https://junglewise.ai/threats/technologies/dcm4chee-arc-light). Vendors: [J4Care](https://junglewise.ai/threats/vendors/j4care).

## Quick answers

**Is CVE-2026-105273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105273 being exploited in the wild.

**How severe is CVE-2026-105273?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** J4Care Dcm4chee-Arc-Light 5.35.1.

**Is there a fix for CVE-2026-105273?** Yes: fixed in 5.35.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105273 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105273?** Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.35.2 or later

## Technical details

The MP4Parser in dcm4chee-arc-light lacks adequate validation of MP4 box sizes, allowing a specially crafted malformed box to create a loop with no forward progress (CWE-835). The vulnerability requires network access to send the malicious MP4 file but no authentication or user interaction; successful exploitation causes denial of service through resource exhaustion. A fix is available in release 5.35.2 or later.

## Affected products

- J4Care dcm4chee-arc-light 5.35.1

## Timeline

- 2026-10-15: disclosed
- 2026-10-16: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02)

## Related threats

- [J4Care dcm4chee-arc-light multiple vulnerabilities](https://junglewise.ai/threats/cve-2026-97851-j4care-dcm4che)
- [J4Care dcm4che JPEGParser infinite loop in JPEG parsing](https://junglewise.ai/threats/cve-2026-107621-jpegparser-can-enter-an-infinite-loop-while-parsing-a-specially)
- [J4Care dcm4che HL7 listener missing authentication for patient merge](https://junglewise.ai/threats/cve-2026-105667-in-the-default-configuration-the-hl7-listener-accepts-adt-a40)
- [J4Care dcm4chee-arc-light DICOM authentication bypass](https://junglewise.ai/threats/cve-2026-105279-in-the-default-configuration-the-archive-accepts-dicom)
- [J4Care dcm4chee-arc-light inefficient algorithmic complexity in multipart parsing](https://junglewise.ai/threats/cve-2026-101021-multipartinputstream-performs-inefficient-boundary-matching-and)