CVE-2026-56445 pydicom CVE debrief

Who should care

Organizations using pydicom's pynetdicom library, especially in medical and industrial control systems, should be aware of this vulnerability and take immediate action to mitigate potential risks. Operators of affected systems, vulnerability management teams, and security teams should prioritize assessment and remediation efforts. The vulnerability's critical severity and potential for arbitrary file writes necessitate prompt attention and defensive measures.

Technical summary

The qrscp application's C-STORE handler in pydicom's pynetdicom library uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths. This vulnerability has a CVSS score of 9.1 and is considered CRITICAL. The affected product is pydicom's pynetdicom library, and the vulnerability is related to the handling of DICOM datasets.

Defensive priority

High priority due to critical severity and potential for arbitrary file writes.

Recommended defensive actions

• Inventory and assess pynetdicom installations for potential exposure
• Implement compensating controls to restrict file writes to expected paths
• Monitor for suspicious activity related to DICOM datasets
• Consider upgrading to pynetdicom version 3.0.4 or later if available
• Perform vulnerability scanning to identify exposed systems
• Review system configurations for potential weaknesses
• Implement additional security controls to prevent exploitation

Evidence notes

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths. Limited information available on affected scope and vendor remediation. Evidence is limited to public sources and may not be comprehensive. Defenders should verify system configurations, review logs for suspicious activity, and assess potential exposure.

Official resources