Description

dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or the DICOM value-representation rules. Scientific notation overflow in a DS or IS field can produce positive or negative Infinity, while stripping alphabetic characters from signed infinity text can leave a sign-only string that converts to NaN. IntegerString also accepts exponent notation and values outside the DICOM signed 32-bit IS range. Applications that trust these parsed values can propagate invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. This issue is fixed in version 0.52.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-05T21:18:50.110Z",
  "pubdate": "2026-11-05T21:18:50.110Z",
  "executiveSummary": "The vulnerability involves improper input validation in dcmjs, specifically within the DecimalString (DS) and IntegerString (IS) Value Representation (VR) parsers. Prior to version 0.52.0, the library utilizes an overly permissive regular expression to sanitize DICOM numeric fields before passing them to the JavaScript Number constructor.\nThis flaw allows for the injection of malformed numeric data, including values that resolve to Infinity or NaN, and the processing of integers exceeding the DICOM specification's 32-bit signed range. An attacker capable of providing a crafted DICOM file can trigger these conditions, leading to downstream logic errors in applications consuming the parsed data.\nThe impact is significant for medical imaging software, as these corrupted values can manifest in critical computational areas such as spatial geometry, dose scaling, frame counts, and volume reconstruction. This may result in misdiagnosis, incorrect clinical measurements, or service disruption. Exploitation does not require authentication or elevated privileges, provided the application processes an attacker-supplied DICOM dataset. Upgrading to version 0.52.0 is required to remediate this defect.",
  "technicalDetails": "The vulnerability resides in the src/ValueRepresentation.js file of the dcmjs library. The core issue stems from an inadequate sanitization mechanism within the DecimalString (DS) and IntegerString (IS) parsing logic. The library employs a permissive regular expression that fails to strictly enforce DICOM value-representation constraints before the string is processed by JavaScript’s native Number constructor.\nIn the case of DecimalString fields, the parser allows for scientific notation that can cause numeric overflow, resulting in the generation of positive or negative Infinity. Furthermore, the regex-based stripping of alphabetic characters from malicious input can yield residual strings—such as signs without digits—that the Number constructor evaluates as NaN (Not-a-Number).\nFor IntegerString fields, the implementation fails to restrict inputs to the DICOM standard's defined range for 32-bit signed integers. The parser accepts scientific notation for fields intended to be discrete integers and permits values that exceed the 32-bit threshold. Because the library does not explicitly validate finiteness or range adherence after the initial sanitization phase, these invalid numeric types (Infinity, NaN, out-of-range integers) are silently propagated into the application's data objects.\nThe attack flow involves an adversary crafting a DICOM object with specifically malformed DS or IS values. When a host application utilizes dcmjs to parse this object, the library generates objects populated with the flawed numeric values. The impact is realized when the application uses these values in downstream operations. For instance, if an 'Infinity' value is used in a display windowing calculation, it can lead to rendering failures or graphical artifacts. If a 'NaN' or out-of-range integer is used in spatial geometry or dose scaling algorithms, the resulting calculations will be mathematically invalid. This leads to silent corruption of clinical data, potentially causing erroneous volumetric reconstructions or dose metrics. The vulnerability exists in all dcmjs versions prior to 0.52.0, which introduced robust validation logic to verify that parsed strings conform to the expected numeric format and range before conversion."
}