Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
DCMTK is an open-source DICOM toolkit built into many imaging devices, PACS gateways, and imaging software. CISA's advisory covers five vulnerabilities in DCMTK versions below 3.7.0. If DCMTK is in your SBOM, this advisory applies to you even though your product isn't named in it.
What the five vulnerabilities do
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-50003 | A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage write files outside the intended directory (CWE-22) | Tampering | High | High |
| CVE-2026-50254 | Repeated crafted connection requests leak memory until a single-process storescp service is killed (CWE-401) | Denial of service | High | High |
| CVE-2026-35505 | Repeated crafted connection requests leak memory until the service stops responding (CWE-401) | Denial of service | High | High |
| CVE-2026-52868 | An unauthenticated attacker can read worklist records outside the intended storage area, crossing department or clinic separation (CWE-22) | Information disclosure | High | High |
| CVE-2026-44628 | A single crafted query can crash the worklist server under specific conditions (CWE-843) | Denial of service | High | High |
All five published vectors are network-reachable, need no privileges, and need no user action. So the CVSS v4.0 calculator's Exploitability field reads High for each. Each has at least one High impact metric, which makes security impact High. On Blue Goat's security matrix, that combination is Critical for all five, as published.
The published vectors describe the library, not your device. If your DICOM services are reachable only on a segmented clinical network, or only after authentication, your deployment changes Attack Vector or Privileges Required. Score your own configuration with the CVSS v4.0 environmental metrics before you rate your risk.
Patient-safety severity is yours to supply. It comes from your ISO 14971 hazard analysis. At High exploitability, Blue Goat's safety matrix returns:
| Severity from your hazard analysis | Safety risk at High exploitability |
|---|---|
| Negligible | Medium |
| Minor or Serious | High |
| Critical or Catastrophic | Very High |
Consider what a denial of service means clinically for your device. An image receiver that stops accepting studies delays diagnosis. A worklist server that crashes stops scheduled imaging. A client that writes files outside its directory can have its software or data altered.
What to check now
- Search your SBOM for DCMTK below 3.7.0. Include statically linked and bundled copies inside imaging applications.
- Identify which DCMTK roles your product runs: a storage receiver (storescp), a worklist server, or a client using bit-preserving C-GET. Each vulnerability needs a specific role to apply.
- If you're not affected, record that in a VEX statement with the justification, for example that the vulnerable role isn't used.
- If you are affected, update to DCMTK 3.7.0 or later. CISA lists versions below 3.7.0 as affected. As of October 27, 2026, the latest DCMTK release tag is 3.7.1. Until you update, limit network exposure of your DICOM ports.
- Re-score the affected threats in your cybersecurity risk assessment, and carry any patient-harm result into your ISO 14971 file.
For a cyber device under section 524B, tracking a component advisory like this is part of the postmarket vulnerability monitoring your cybersecurity management plan describes.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.