DICOM Viewer Vulnerability in OHIF Viewers and Extensions
CVE-2026-118670
What is CVE-2026-118670?
The OHIF Viewers are a zero-footprint DICOM viewer that allows attackers to manipulate the MIMETypeOfEncapsulatedDocument value through the dicom-pdf extension. This can lead to unsafe handling of Blob media types, enabling an attacker to exploit the application's web context. Once a victim interacts with a malicious DICOM object, it can embed potentially harmful scripts that access sensitive information like session storage and authentication tokens from the OHIF origin. To mitigate this risk, updates have been issued in versions 3.12.15, 3.13.7, and 3.14.0-beta.19, which address these vulnerabilities.
Affected Version(s)
Viewers >= 3.5.0-beta.0, < 3.12.15 < 3.5.0-beta.0, 3.12.15
Viewers >= 3.13.0-beta.0, < 3.13.7 < 3.13.0-beta.0, 3.13.7
Viewers >= 3.14.0-beta.0, < 3.14.0-beta.19 < 3.14.0-beta.0, 3.14.0-beta.19