The vulnerability CVE-2026-17583 affects forensic DNA evidence files (.fsa and .hid) generated by Thermo Fisher's Applied Biosystems human identification instruments. The files can be modified after being written by the instrument but before being loaded by the analysis software, without any warning or detection. Researchers showed that it is possible to merge DNA profiles into a single file that appears authentic and unchanged since 2015. Thermo Fisher's bulletin states that digital signatures have been added to files written after the update to prevent tampering, but no mechanism exists to validate files created before the update. Additionally, some end-of-life products will not receive updates, leaving older forensic evidence files vulnerable to undetected manipulation.

The vulnerability allows undetectable tampering with forensic DNA evidence files, potentially compromising the integrity of forensic evidence used in legal and investigative contexts. Modified files can merge multiple DNA profiles into one, misleading analysis results without raising any software warnings. The lack of retroactive validation and absence of updates for some end-of-life products means that historical forensic evidence remains at risk, which could undermine trust in forensic processes and outcomes.

Thermo Fisher has issued a bulletin implementing digital signatures on forensic DNA evidence files created after the update, which protects new files from tampering. However, no retroactive validation exists for files created prior to the update, and some end-of-life products will not receive patches. Users should apply the update to supported products to ensure new files are protected. For older files, no technical mitigation is currently available; organizations should consider additional procedural controls such as maintaining strict write-access logs and chain-of-custody documentation to detect potential tampering retrospectively.