PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56445 pydicom CVE debrief

The CVE record for CVE-2026-56445 was published on 2026-06-25T06:00:00.000Z and has not been modified since then. The NVD entry is currently 9.1 CRITICAL. The qrscp application's C-STORE handler in pydicom's pynetdicom library uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths. This vulnerability has a CVSS score of 9.1 and is considered CRITICAL. The affected product is pydicom's pynetdicom library, and the vulnerability is related to the handling of DICOM datasets. Organizations using pydicom's pynetdicom library, especially in medical and industrial control systems, should be aware of this vulnerability and take immediate action to mitigate potential risks. Operators of affected systems, vulnerability management teams, and security teams should prioritize assessment and remediation efforts. The vulnerability's critical severity and potential for arbitrary file writes necessitate prompt attention and defensive measures. Limited information available on affected scope and vendor remediation. Evidence is limited to public sources and may not be comprehensive. Defenders should verify system configurations, review logs for suspicious activity, and assess potential exposure.

Vendor
pydicom
Product
pynetdicom
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-06-25
Advisory published
2026-06-25
Advisory updated
2026-06-25

Who should care

Organizations using pydicom's pynetdicom library, especially in medical and industrial control systems, should be aware of this vulnerability and take immediate action to mitigate potential risks. Operators of affected systems, vulnerability management teams, and security teams should prioritize assessment and remediation efforts. The vulnerability's critical severity and potential for arbitrary file writes necessitate prompt attention and defensive measures.

Technical summary

The qrscp application's C-STORE handler in pydicom's pynetdicom library uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths. This vulnerability has a CVSS score of 9.1 and is considered CRITICAL. The affected product is pydicom's pynetdicom library, and the vulnerability is related to the handling of DICOM datasets.

Defensive priority

High priority due to critical severity and potential for arbitrary file writes.

Recommended defensive actions

  • Inventory and assess pynetdicom installations for potential exposure
  • Implement compensating controls to restrict file writes to expected paths
  • Monitor for suspicious activity related to DICOM datasets
  • Consider upgrading to pynetdicom version 3.0.4 or later if available
  • Perform vulnerability scanning to identify exposed systems
  • Review system configurations for potential weaknesses
  • Implement additional security controls to prevent exploitation

Evidence notes

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths. Limited information available on affected scope and vendor remediation. Evidence is limited to public sources and may not be comprehensive. Defenders should verify system configurations, review logs for suspicious activity, and assess potential exposure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56445 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56445

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56445 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56445

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsma-26-176-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-176-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.