External risk intelligence

dcmjs Number Parsing Vulnerability Leads to Calculation Errors.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-46350

dcmjs is a library for processing DICOM medical imaging data. It is used as a backend or utility component within medical software applications to parse file data, not as a public-facing service, gateway, or internet-exposed endpoint. Exposure typically occurs only if a developer integrates the library into an application that processes untrusted, user-supplied DICOM files, which is not standard public-facing deployment.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in dcmjs, a JavaScript library for handling medical imaging data. The issue allows for the processing of malformed numerical data, which could lead to incorrect calculations or disruptions in applications that rely on these values for critical functions like spatial geometry or dose scaling. The primary concern is to confirm if our organization utilizes this library and, if so, to understand the potential impact on systems processing medical imaging data.

Malformed data could disrupt medical imaging calculations.
Confirm if this medical imaging library is used.
Understand exposure and impact on critical systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted DICOM files to an application that uses the dcmjs library. The application would then process these files, leading to unexpected behavior.

Requires processing of untrusted data.
Vulnerable number parsing in DICOM data.
Potential for calculation errors or processing disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect applications that use dcmjs to process DICOM files. When improperly sanitized DecimalString or IntegerString values are used, applications might encounter incorrect calculations in areas like spatial geometry, display windowing, or volume reconstruction due to unexpected numeric results like Infinity or NaN.

Medical image processing calculations.
Malformed DICOM files could be processed.
Inaccurate medical imaging results.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely involves application owners and platform teams responsible for integrating and managing the dcmjs library. The first step is to identify all applications utilizing dcmjs, assess their exposure and criticality, and confirm the accountable teams for remediation planning.

Application owners must investigate usage.
Verify processing of untrusted DICOM files.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is dcmjs?

dcmjs is a JavaScript library used by developers to parse and manipulate DICOM files, which are the industry standard for storing and exchanging medical imaging data. It provides the low-level logic required to interpret complex imaging metadata, such as scan parameters and patient information, allowing web-based or server-side medical applications to read and display clinical images correctly.

How does CVE-2026-46350 affect number parsing?

This vulnerability, involving Improper Input Validation (CWE-20) and Improper Validation of Specified Quantity in Input (CWE-1284), occurs because the library uses overly permissive rules when reading numerical data. Instead of ensuring values are valid numbers, it can inadvertently convert malformed strings into 'Infinity' or 'NaN' (Not a Number), which breaks calculations that depend on precise mathematical inputs.

Can any DICOM file trigger this bug?

No. The issue only manifests when an application processes a specifically crafted DICOM file containing malformed DecimalString or IntegerString values. If a file contains standard, compliant DICOM data, the library handles the inputs correctly; the vulnerability specifically requires an attacker to supply malicious input designed to force the parser into an error state.

Do I need to worry if my system is internal?

According to Halo Surface Signal, this library is typically used as a backend utility rather than an internet-facing gateway. While this makes direct, external exploitation less common, you should still care if your internal applications process untrusted DICOM files from third parties or external sources, as these represent a potential vector for the malformed data that triggers the flaw.

What should I do to secure my environment?

Begin by auditing your software inventory to identify which applications include dcmjs. Once identified, prioritize updating the library to version 0.52.0 or later, which contains the necessary validation fixes. Coordinate with your development or vendor teams to ensure these updates are applied, particularly for critical imaging systems that perform automated dose scaling or volume reconstruction.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.