CVE-2026-46350— dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

Quick assessment

Affected

dcmjs-org dcmjs

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

dcmjs 是一个用 JavaScript 实现的 DICOM 操作库。在 0.52.0 版本之前，src/ValueRepresentation.js 中的 DecimalString 和 IntegerString 实现使用宽松的正则表达式对文本进行清理，随后将结果直接传递给 JavaScript 的 Number 构造函数，而未验证其有限性或是否符合 DICOM 值表示（Value Representation）规则。在 DS 或 IS 字段中，科学计数法可能导致上溢，从而产生正无穷或负无穷；而从带符号的无穷

CVSS 9.1 · Critical Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1069 · Permission Groups Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

Source: CVE Program / CVE List V5

Vulnerability Description

dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or the DICOM value-representation rules. Scientific notation overflow in a DS or IS field can produce positive or negative Infinity, while stripping alphabetic characters from signed infinity text can leave a sign-only string that converts to NaN. IntegerString also accepts exponent notation and values outside the DICOM signed 32-bit IS range. Applications that trust these parsed values can propagate invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. This issue is fixed in version 0.52.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
dcmjs-org	dcmjs	< 0.52.0	-

II. Public POCs for CVE-2026-46350

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-46350

请登录查看更多情报信息。

Other References for CVE-2026-46350 (4)

https://github.com/dcmjs-org/dcmjs/pull/497 x_refsource_MISC
https://github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0 x_refsource_MISC
https://github.com/dcmjs-org/dcmjs/security/advisories/GHSA-px68-xx5g-48q5 x_refsource_CONFIRM
https://github.com/dcmjs-org/dcmjs/commit/81e7e11cdefb56aa1a65bfe259648b865583ff88 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-46350

IV. Related Vulnerabilities

Same weakness: CWE-20