CVE-2026-105273

validated

EUVD-2026-102892 ↗

check availablenot proven exploitable

cve.orgpublic pockev

J4Care dcm4chee-arc-light 5.35.1

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

ETK-2026-1785, permanent identifier

cvss8.7cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

+1h41mTTV

25mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0mcheck available+101magent stopped

+30min

+60min

+90min

description

J4Care dcm4chee-arc-light is reported affected, although the supplied evidence does not identify affected version ranges. An attacker able to have a malformed MP4 processed may cause the parser to repeatedly handle the same input, disrupting availability.

mitigation

Restrict or disable processing of untrusted MP4 files, and apply execution-time and resource limits to MP4 parsing workloads. Monitor for a vendor update and upgrade when a fixed release is published; no fixed version is recorded in the supplied package data.

check

available

exploit

automation

deterministic

auth required

EPSS

0.34%26th percentile

agent run time

25m

cve.org record, t = 0

2026-10-16 14:21Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-16 14:21Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-105273

this entry in the feed

GET /api/v1/feed/CVE-2026-105273

{
  "etk_id": "ETK-2026-1785",
  "cve_id": "CVE-2026-105273",
  "display_id": "CVE-2026-105273",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-102892",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Malformed MP4 parsing infinite loop in dcm4chee-arc-light",
  "summary": "J4Care dcm4chee-arc-light is reported affected, although the supplied evidence does not identify affected version ranges. An attacker able to have a malformed MP4 processed may cause the parser to repeatedly handle the same input, disrupting availability.",
  "mitigation": "Restrict or disable processing of untrusted MP4 files, and apply execution-time and resource limits to MP4 parsing workloads. Monitor for a vendor update and upgrade when a fixed release is published; no fixed version is recorded in the supplied package data.",
  "vendor": "J4Care",
  "product": "dcm4chee-arc-light",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "5.35.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "dcm4chee-arc-light",
      "purl": null
    }
  ],
  "cwes": [
    835
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0034,
  "epss_percentile": 0.2642,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 24.5604495,
  "t0_at": "2026-10-16T14:21:12.116000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-16T16:02:17.911526+00:00",
      "days": 0.07020596673611111,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T14:21:12.116000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T14:21:12.116000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T14:21:12.116000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105273"
    }
  }
}

published 2026-10-16 15:37Z
last change 2026-10-21 13:29Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.