CVE-2026-5442

A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimension fields are encoded using Value Representation (VR) Unsigned Long (UL), instead of the expected VR Unsigned Short (US), which allows extremely large dimensions to be processed. This causes an integer overflow during frame size calculation and results in out-of-bounds memory access during image decoding.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.cert.org/vuls/id/536588	Third Party Advisory VDB Entry
https://www.machinespirits.de/	Not Applicable
https://www.orthanc-server.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de desbordamiento de búfer de montón en el decodificador de imágenes DICOM. Los campos de dimensión están codificados utilizando Representación de Valor (VR) Entero Largo Sin Signo (UL), en lugar de la esperada VR Entero Corto Sin Signo (US), lo que permite que se procesen dimensiones extremadamente grandes. Esto provoca un desbordamiento de entero durante el cálculo del tamaño del fotograma y da como resultado un acceso a memoria fuera de límites durante la decodificación de la imagen.

Information

Published : 2026-04-09 15:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-5442

Mitre link : CVE-2026-5442

CVE.ORG link : CVE-2026-5442

JSON object : View

Products Affected

orthanc-server

orthanc

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-5442", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5442", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T15:12:07.779154Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Orthanc", "product": "DICOM Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.12.10"}]}]}], "published": "2026-04-09T15:16:16.543", "references": [{"url": "https://kb.cert.org/vuls/id/536588", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}, {"url": "https://www.machinespirits.de/", "tags": ["Not Applicable"], "source": "cret@cert.org"}, {"url": "https://www.orthanc-server.com/", "tags": ["Product"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimension fields are encoded using Value Representation (VR) Unsigned Long (UL), instead of the expected VR Unsigned Short (US), which allows extremely large dimensions to be processed. This causes an integer overflow during frame size calculation and results in out-of-bounds memory access during image decoding."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n en el decodificador de im\u00e1genes DICOM. Los campos de dimensi\u00f3n est\u00e1n codificados utilizando Representaci\u00f3n de Valor (VR) Entero Largo Sin Signo (UL), en lugar de la esperada VR Entero Corto Sin Signo (US), lo que permite que se procesen dimensiones extremadamente grandes. Esto provoca un desbordamiento de entero durante el c\u00e1lculo del tama\u00f1o del fotograma y da como resultado un acceso a memoria fuera de l\u00edmites durante la decodificaci\u00f3n de la imagen."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A259075D-8B77-4B04-BC42-3E5ABE9DFE1F", "versionEndExcluding": "1.12.11"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}