CVE-2026-118670

Summary

The OHIF Viewer's dicom-pdf extension incorrectly uses attacker-controlled MIME type values to render encapsulated PDF documents as HTML blobs, enabling script execution in the OHIF origin. This allows theft of session tokens, storage data, and same-origin PACS requests via malicious DICOM files.

Exploitability

Exploitation requires a victim to open a specially crafted DICOM file containing a malicious EncapsulatedDocument with MIME type 'text/html' or similar HTML-capable type; user interaction is required (CVSS UI:R).

Blast radius

Successful exploitation grants attackers full access to the victim's OHIF session, including authentication tokens and PACS data, potentially enabling lateral movement within the imaging infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OHIF Viewer versions 3.12.15, 3.13.7, or 3.14.0-beta.19 (or later) to patch the MIME type validation flaw in the dicom-pdf extension.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.