Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
pynetdicom is an open-source Python library for DICOM networking. It shows up in imaging software, research tools, and SaMD back ends. CISA's advisory covers one vulnerability in its qrscp application. CISA reports that the maintainer has not responded to requests to fix it. If pynetdicom is in your SBOM, there may be no upstream fix to wait for.
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-56445 | qrscp's C-STORE handler uses a value from an attacker-supplied DICOM dataset to build a file path without sanitizing it, allowing file writes to arbitrary paths (CWE-22) | Tampering | High | High |
The published vector is network-reachable with no privileges and no user action, so Exploitability reads High. Integrity and availability impacts are High. On Blue Goat's security matrix, that's Critical as published.
The published vectors describe the software, not your device. If the service is reachable only on a segmented clinical network or behind authentication, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.
| Severity from your hazard analysis | Safety risk at High exploitability |
|---|---|
| Negligible | Medium |
| Minor or Serious | High |
| Critical or Catastrophic | Very High |
An attacker who can write files anywhere the service can write may be able to alter images, configuration, or software on the host.
What to check now
- Search your SBOM for pynetdicom, including in Python dependencies of imaging or analysis services.
- Check whether your product runs the qrscp application, or builds on its C-STORE handling. If not, record that in a VEX statement with the justification.
- If you're affected, don't wait for an upstream fix. As of October 27, 2026, the latest pynetdicom release is v3.0.4, from August 2025, which predates the advisory. Restrict network access to the service, and consider validating file paths in your own code.
- Re-score the threat, and carry any patient-harm result into your ISO 14971 file.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.