# CVE-2026-105667: J4Care dcm4chee-arc-light multiple vulnerabilities

Source: https://junglewise.ai/threats/cve-2026-97851-j4care-dcm4che  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-105667 · Severity: critical · CVSS 9.1 · Published 2026-10-16

dcm4chee-arc-light is a medical imaging archive used in healthcare systems to store and manage DICOM patient images and records. Multiple vulnerabilities in this system could allow attackers to delete medical images, access patient information, inject fake studies, reassign patient records, and cause service outages, compromising patient care and data privacy in critical healthcare infrastructure.

Technologies: [J4Care Dcm4chee-Arc-Light](https://junglewise.ai/threats/technologies/dcm4chee-arc-light). Vendors: [J4Care](https://junglewise.ai/threats/vendors/j4care).

## Quick answers

**Is CVE-2026-105667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105667 being exploited in the wild.

**How severe is CVE-2026-105667?** Critical severity, with a CVSS score of 9.1, published 16 October 2026.

**Which products and versions are affected?** J4Care Dcm4chee-Arc-Light 5.35.1.

**Is there a fix for CVE-2026-105667?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105667 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-105667?** Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The affected version 5.35.1 contains missing authorization controls, missing authentication for critical functions, infinite loops causing denial of service, and inefficient algorithmic complexity issues. These flaws enable unauthenticated or inadequately authorized network attacks on the DICOM archive interface, allowing attackers to manipulate or delete stored medical data and patient records without proper authentication or authorization checks.

## Affected products

- J4Care dcm4chee-arc-light 5.35.1

## Identifiers

- CVE-2026-105667
- CVE-2026-107621
- CVE-2026-105279
- CVE-2026-105273
- CVE-2026-97851
- CVE-2026-101021

## Timeline

- 2026-10-15: disclosed

## Related threats

- [J4Care dcm4che JPEGParser infinite loop in JPEG parsing](https://junglewise.ai/threats/cve-2026-107621-jpegparser-can-enter-an-infinite-loop-while-parsing-a-specially)
- [J4Care dcm4che HL7 listener missing authentication for patient merge](https://junglewise.ai/threats/cve-2026-105667-in-the-default-configuration-the-hl7-listener-accepts-adt-a40)
- [J4Care dcm4chee-arc-light DICOM authentication bypass](https://junglewise.ai/threats/cve-2026-105279-in-the-default-configuration-the-archive-accepts-dicom)
- [J4Care dcm4chee-arc-light MP4Parser infinite loop in MP4 box parsing](https://junglewise.ai/threats/cve-2026-105273-mp4parser-does-not-adequately-validate-mp4-box-sizes-a-malformed)
- [J4Care dcm4chee-arc-light inefficient algorithmic complexity in multipart parsing](https://junglewise.ai/threats/cve-2026-101021-multipartinputstream-performs-inefficient-boundary-matching-and)