dicom

Nine vulnerabilities in the open source Digital Imaging and Communications in Medicine (DICOM) server Orthanc allow attackers to crash servers, leak data, and execute arbitrary code remotely. A lightweight standalone DICOM server for healthcare and medical research, Orthanc supports the automated analysis of medical images and does not require complex database administration or third-party dependencies. The nine security defects in Orthanc, tracked CVE-2026-5437 to CVE-2026-5445, are rooted in insufficient validation of metadata, missing checks, and unsafe arithmetic operations, CERT Coordination Center (CERT/CC) notes in an advisory. The first bug is an out-of-bounds read issue affecting the meta-header parser, caused by insufficient input validation in the parsing logic. Next is a GZIP decompression bomb flaw in the processing of specific HTTP requests. Because no limit is enforced on decompressed size, and memory is allocated based on attacker-controlled metadata, a malicious payload could be used to exhaust system memory. Another memory exhaustion defect was discovered in ZIP archive processing, where the server trusts metadata describing the uncompressed size of the archived files, allowing an attacker to forge size values and cause the server to allocate extremely large buffers during extraction. The HTTP server was also found to allocate memory directly based on user-supplied header values, allowing attackers to craft an HTTP request containing an extremely large length value, triggering server termination. Orthanc’s decompression routine for the proprietary Philips Compression format is affected by an out-of-bounds read vulnerability, where escape markers at the end of the compressed data stream are improperly validated. “A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output,” the CERT/CC advisory reads. Another out-of-bounds read weakness was identified in the lookup-table decoding logic for Palette Color images, which fails to validate pixel indices. The flaw can be exploited via crafted images with indices larger than the palette size. The last three security defects are heap buffer overflow issues impacting the image decoder, Palette Color image decoding logic, and PAM image parsing logic. Successful exploitation of these vulnerabilities could lead to out-of-bounds memory access. “The most severe issues are heap-based buffer overflows in image parsing and decoding logic, which can crash the Orthanc process and may, under certain conditions, provide a pathway to remote code execution (RCE),” the CERT/CC advisory reads. Orthanc versions 1.12.10 and earlier are affected by these bugs. Users are advised to update to version 1.12.11, which addresses all of them. The vulnerabilities were discovered by researchers at Machine Spirits, who published their own advisories. Related: Critical Marimo Flaw Exploited Hours After Public Disclosure Related: Microsoft Finds Vulnerability Exposing Millions of Android Crypto Wallet Users Related: Data Leakage Vulnerability Patched in OpenSSL Related: RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years

The devices winning the race to get hacked in 2026 Enterprise networks keep adding connected devices, expanding the attack surface as threat actors target a wider range of systems, many of which are difficult to inventory, secure, and patch consistently. (Source: Forescout) Forescout’s 2026 Riskiest Devices research maps that shift in IT, IoT, OT, and IoMT environments, with 11 new riskiest asset types entering the list this year. That is the second-largest year-over-year increase on record, and two of the new entries moved straight into the top five riskiest IT assets: serial-to-IP-converters and workstations. Device risk spans IT, IoT, OT, and IoMT environments The highest-risk IT category remains the router. Forescout also highlights an average of 32 vulnerabilities per router/switch. The 2026 IT top five are router, serial-to-IP converter, workstation, firewall, and domain controller. This ranking keeps core network and administrative systems central to enterprise device risk, with access, traffic control, and identity systems grouped together. The IoT list stays rooted in operational devices that sit close to daily business activity. The top five IoT categories are VoIP system, printer, time clock, network video recorder (NVR), and RFID reader. In OT, the list is power distribution unit (PDU), physical address control system, uninterruptible power supply (UPS), I/O module, and BACnet router. In IoMT, the top five are medication dispensing system, medical image printer, DICOM gateway, MRI scanner, and healthcare workstation. Imaging devices lead the IoMT category overall. The 2026 list includes 20 device types spanning the four domains. Financial services and government lead device risk levels Financial services records the highest average device risk in 2026, followed by government and healthcare. Average device risk in financial services is more than three times that of retail, and government risk is more than double manufacturing. These gaps place both sectors at the top of the industry range. Embedded firmware and networking operating systems, grouped as “special operating systems,” appear in government at 72%, retail at 61%, and healthcare at 56%. These systems outnumber mobile operating systems in the dataset and include version tracking limitations, limited automatic patching, and a large share of outdated or unsupported firmware. Legacy Windows systems remain widely deployed. Retail stands at 39%, healthcare at 35%, and financial services at 29%. These shares increased after the end of support for Windows 10. In all five industries included in the comparison, more than half of non-legacy Windows devices previously ran Windows 10, leaving a significant portion tied to a recent support transition. Secure Shell (SSH) is now the second most common protocol, with increased exposure in every industry except retail. Telnet usage increased in financial services, healthcare, and manufacturing, with slight declines in government and retail. Financial services rose from 3% to 12%, manufacturing from 5% to 12%, and healthcare from 6% to 8%. “The attack surface in modern organizations spans IT, IoT, and OT, with the Internet of Medical Things adding complexity in healthcare. Focusing security efforts on a single domain is no longer sufficient: attackers exploit weaknesses across multiple environments and pivot between them,” researchers warn.

Can a computer be infected with malware simply by processing a photo — particularly if that computer is a Mac, which many still believe (wrongly) to be inherently resistant to malware? As it turns out, the answer is yes — if you’re using a vulnerable version of ExifTool or one of the many apps built based on it. ExifTool is a ubiquitous open-source solution for reading, writing, and editing image metadata. It’s the go-to tool for photographers and digital archivists, and is widely used in data analytics, digital forensics, and investigative journalism. Our GReAT experts discovered a critical vulnerability — tracked as CVE-2026-3102 — which is triggered during the processing of malicious image files containing embedded shell commands within their metadata. When a vulnerable version of ExifTool on macOS processes such a file, the command is executed. This allows a threat actor to perform unauthorized actions in the system, such as downloading and executing a payload from a remote server. In this post, we break down how this exploit works, provide actionable defense recommendations, and explain how to verify if your system is vulnerable. What is ExifTool? ExifTool is a free, open-source application addressing a niche but critical requirement: it extracts metadata from files, and enables the processing of both that data and the files themselves. Metadata is the information embedded within most modern file formats that describes or supplements the main content of a file. For instance, in a music track, metadata includes the artist’s name, song title, genre, release year, album cover art, and so on. For photographs, metadata typically consists of the date and time of a shot, GPS coordinates, ISO and shutter speed settings, and the camera make and model. Even office documents store metadata, such as the author’s name, total editing time, and the original creation date. ExifTool is the industry leader in terms of the sheer volume of supported file formats, as well as the depth, accuracy, and versatility of its processing capabilities. Common use cases include: Adjusting dates if they’re incorrectly recorded in the source files Moving metadata between different file formats (from JPG to PNG and so on) Pulling preview thumbnails from professional RAW formats (such as 3FR, ARW, or CR3) Retrieving data from niche formats, including FLIR thermal imagery, LYTRO light-field photos, and DICOM medical imaging Renaming photo/video (etc.) files based on the time of actual shooting, and synchronizing the file creation time and date accordingly Embedding GPS coordinates into a file by syncing it with a separately stored GPS track log, or adding the name of the nearest populated area The list goes on and on. ExifTool is available both as a standalone command-line application and an open-source library, meaning its code often runs under the hood of powerful, multi-purpose tools; examples include photo organization systems like Exif Photoworker and MetaScope, or image processing automation tools like ImageIngester. In large digital libraries, publishing houses, and image analytics firms, ExifTool is frequently used in automated mode, triggered by internal enterprise applications and custom scripts. How CVE-2026-3102 works To exploit this vulnerability, an attacker must craft an image file in a certain way. While the image itself can be anything, the exploit lies in the metadata — specifically the DateTimeOriginal field (date and time of creation), which must be recorded in an invalid format. In addition to the date and time, this field must contain malicious shell commands. Due to the specific way ExifTool handles data on macOS, these commands will execute only if two conditions are met: The application or library is running on macOS The -n (or –printConv) flag is enabled. This mode outputs machine-readable data without additional processing, as is. For example, in -n mode, camera orientation data is output simply, inexplicably, as “six”, whereas with additional processing, it becomes the more human-readable “Rotated 90 CW”. This “human-readability” prevents the vulnerability from being exploited A rare but by no means fantastical scenario for a targeted attack would look like this: a forensics laboratory, a media editorial office, or a large organization that processes legal or medical documentation receives a digital document of interest. This can be a sensational photo or a legal claim — the bait depends on the victim’s line of work. All files entering the company undergo sorting and cataloging via a digital asset management (DAM) system. In large companies, this may be automated; individuals and small firms run the required software manually. In either case, the ExifTool library must be used under the hood of this software. When processing the date of the malicious photo, the computer where the processing occurs is infected with a Trojan or an infostealer, which is subsequently capable of stealing all valuable data stored on the attacked device. Meanwhile, the victim could easily notice nothing at all, as the attack leverages the image metadata while the picture itself may be harmless, entirely appropriate, and useful. How to protect against the ExifTool vulnerability GReAT researchers reported the vulnerability to the author of ExifTool, who promptly released version 13.50, which is not susceptible to CVE-2026-3102. Versions 13.49 and earlier must be updated to remediate the flaw. It’s critical to ensure that all photo processing workflows are using the updated version. You should verify that all asset management platforms, photo organization apps, and any bulk image processing scripts running on Macs are calling ExifTool version 13.50 or later, and don’t contain an embedded older copy of the ExifTool library. Naturally, ExifTool — like any software — may contain additional vulnerabilities of this class. To harden your defenses, we also recommend the following: Isolate the processing of untrusted files. Process images from questionable sources on a dedicated machine or within a virtual environment, strictly limiting its access to other computers, data storage, and network resources. Continuously track vulnerabilities along the software supply chain. Organizations that rely on open-source components in their workflows can use Open Source Software Threats Data Feed for tracking. Finally, if you work with freelancers or self-employed contractors (or simply allow BYOD), only allow them to access your network if they have a comprehensive macOS security solution installed. Still think macOS is safe? Then read about these Mac threats:

Healthcare security is broken because its systems can’t talk to each other In this Help Net Security interview, Cameron Kracke, CISO at Prime Therapeutics, discusses how the healthcare ecosystem can achieve cohesive security visibility. With hospitals, clinics, telehealth, and cloud partners all in the mix, maintaining visibility remains a complex task. Kracke shares how interoperability, collaboration, and strategic investment can strengthen resilience across the healthcare security landscape. When you look at the modern healthcare ecosystem with hospitals, clinics, telehealth, medical devices, and cloud partners, what is the biggest barrier to achieving cohesive security visibility across them all? The primary barrier to unified security visibility is ecosystem fragmentation. Healthcare organizations routinely integrate legacy, on-premises systems with modern cloud-native applications and a growing array of connected medical devices, and client or clinical applications. This fragmentation is further exacerbated by: Variances in industry standards, including differing file formats, communication protocols, and data exchange mechanisms (e.g., HL7, FHIR, DICOM) which may complicate interoperability and make it difficult to aggregate and correlate security events across platforms. Heterogeneous network connectivity: Disparate connectivity models, ranging from secure internal networks to third-party telehealth connections, can create blind spots and inconsistent visibility. Software development lifecycle (SDLC) complexities: Multiple development teams, vendors, and release cycles hinder the standardization of security controls, monitoring, and incident response processes. These technical and procedural variances collectively impede the creation of a centralized, actionable security view, increasing the risk of undetected threats and compliance gaps. Achieving cohesive security visibility in healthcare ecosystem requires organizations to address deep-rooted fragmentation, standardize data and process integration, and adapt to persistent budget and talent constraints. By strategically prioritizing interoperability, embedding security into the SDLC, optimizing resources, and investing in talent, organizations can build a resilient security visibility framework, one capable of protecting patient data and supporting clinical excellence. Security tools in healthcare often come from dozens of vendors. How can organizations balance the need for interoperability without creating vendor lock-in or integration fatigue? Healthcare security teams often juggle tools from numerous vendors, making it crucial to strike a balance between deploying point solutions and adopting integrated platforms. Relying on too many disparate tools can lead to integration and support fatigue, increased complexity, and the risk of alert overload, all factors that may strain staff capacity, contribute to burnout, or attrition. On the other hand, consolidating security controls within integrated solutions can streamline management, enhance interoperability, increase visibility response time, and reduce operational burden. However, organizations must be cautious to avoid vendor lock-in, which can limit flexibility and hinder the adoption of best-of-breed capabilities as needs evolve. The choice between point solutions and integrated platforms directly impacts budget allocation, resource requirements, and the long-term agility of security operations. To maintain effectiveness, healthcare organizations should continually evaluate their security toolset for relevance, integration potential, and overall value to the security program. Prioritizing solutions that support open standards, and seamless integration helps minimize context switching and alert fatigue, while ensuring that the security team remains engaged and productive. Ultimately, the decision to balance specialized point solutions with broader integrated platforms must be guided by strategic priorities, resource capacity, and the need to support both operational efficiency and clinical excellence. Thoughtful tool selection and ongoing assessment are essential for building a resilient, sustainable security posture in healthcare environment. With so many healthcare applications moving to the cloud, how do you design an ecosystem that bridges on-premises legacy systems with modern cloud-native security tools? As healthcare organizations increasingly migrate applications to the cloud, designing an ecosystem that bridges legacy on-premises systems with modern cloud-native security tools is essential. The right approach depends on each organization’s cloud strategy, whether transitioning fully to the cloud or maintaining a hybrid environment, and whether they operate in single or multi-cloud architectures. A critical consideration is the interoperability of security tools across both cloud and on-premises environments. Healthcare organizations must assess if their security solutions need to span multiple cloud providers, support on-premises systems, or both, and determine how long on-premises support will be necessary as applications gradually shift to the cloud. Cloud providers are increasingly acquiring and integrating advanced security technologies, offering unified solutions that reduce the need for multiple monitoring platforms. This consolidation not only lessens alert fatigue but also enhances real-time visibility to security threats, an important advantage for healthcare, where timely detection is vital for protecting patient data and ensuring clinical continuity. Ultimately, there is no universal solution. Healthcare organizations must develop and communicate a comprehensive plan for cloud adoption, application deployment, and data storage. Strategic planning and ongoing evaluation are crucial to supporting both operational efficiency and the protection of sensitive health information. How can healthcare organizations reconcile the tension between security and clinical usability, especially when lives depend on system uptime? In healthcare, the tension between security and clinical usability (or anything healthcare related) is especially critical, as system uptime can directly impact member/patient outcomes. To address this challenge, security leadership mindset must shift from a default stance of “no” to a more collaborative “yes and” approach, recognizing that mitigating security risk should not come at the expense of business or member risk. Security teams should view themselves as business enablers, working proactively to find secure solutions that support organizational goals. Instead of blocking initiatives for the sake of security, leaders must develop creative new strategies that both protect sensitive information and facilitate successful business outcomes. This can occur when security teams have a seat at the table early-on in the operational conversation. This cultural transformation requires time, ongoing practice, and strong leadership. Team members may progress at different rates, but it is the responsibility of leaders to guide and unify the organization toward the shared goal: enabling the business safely and securely, while minimizing the tension between protection and productivity. This also may be an opportunity to engage with a change management coach to bring about a more successful outcome. What lessons can healthcare security teams borrow from public health, such as information sharing or community defense, when thinking about ecosystem resilience? Healthcare organizations face a unique but universal challenge: threat actors are constantly targeting their sensitive data. This shared risk underscores the importance of coming together as a community to strengthen collective defenses. By recognizing that attackers do not discriminate, organizations can better appreciate the value of collaboration in building a resilient security ecosystem. Information sharing is a critical component of this collaborative approach. When organizations openly exchange threat intelligence, vulnerabilities, and best practices, they empower each other to respond more quickly and effectively to emerging threats. Groups such as HS-ISAC and FBI InfraGard offer trusted environments for this information exchange, helping to bridge gaps across the industry and enhance the security posture. Beyond information sharing, healthcare security teams can adopt additional strategies from public health, such as establishing community defense mechanisms. This could include joint incident response exercises, coordinated vulnerability management, and the development of shared security standards. Regular cross-industry drills and communication channels can further improve readiness and reaction times during cyber incidents. Ultimately, building a more resilient and effective security ecosystem requires both cultural and operational shifts. Organizations must foster trust, prioritize transparency, and make security a shared responsibility across all teams. By working together and learning from public health models, healthcare organizations can better defend against threats and support safer, more reliable care delivery.