CVE-2026-5444

A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic. Specially chosen values can cause an integer overflow during buffer size calculation, resulting in the allocation of a small buffer followed by a much larger write operation during pixel processing.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.cert.org/vuls/id/536588	Third Party Advisory VDB Entry
https://www.machinespirits.de/	Not Applicable
https://www.orthanc-server.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de desbordamiento de búfer de montón en la lógica de análisis de imágenes PAM. Cuando Orthanc procesa una imagen PAM manipulada incrustada en un archivo DICOM, las dimensiones de la imagen se multiplican utilizando aritmética sin signo de 32 bits. Valores especialmente elegidos pueden causar un desbordamiento de entero durante el cálculo del tamaño del búfer, lo que resulta en la asignación de un búfer pequeño seguido de una operación de escritura mucho mayor durante el procesamiento de píxeles.

Information

Published : 2026-04-09 15:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-5444

Mitre link : CVE-2026-5444

CVE.ORG link : CVE-2026-5444

JSON object : View

Products Affected

orthanc-server

orthanc

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-5444", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5444", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:08:02.200164Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Orthanc", "product": "DICOM Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.12.10"}]}]}], "published": "2026-04-09T15:16:16.760", "references": [{"url": "https://kb.cert.org/vuls/id/536588", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}, {"url": "https://www.machinespirits.de/", "tags": ["Not Applicable"], "source": "cret@cert.org"}, {"url": "https://www.orthanc-server.com/", "tags": ["Product"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic. Specially chosen values can cause an integer overflow during buffer size calculation, resulting in the allocation of a small buffer followed by a much larger write operation during pixel processing."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n en la l\u00f3gica de an\u00e1lisis de im\u00e1genes PAM. Cuando Orthanc procesa una imagen PAM manipulada incrustada en un archivo DICOM, las dimensiones de la imagen se multiplican utilizando aritm\u00e9tica sin signo de 32 bits. Valores especialmente elegidos pueden causar un desbordamiento de entero durante el c\u00e1lculo del tama\u00f1o del b\u00fafer, lo que resulta en la asignaci\u00f3n de un b\u00fafer peque\u00f1o seguido de una operaci\u00f3n de escritura mucho mayor durante el procesamiento de p\u00edxeles."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A259075D-8B77-4B04-BC42-3E5ABE9DFE1F", "versionEndExcluding": "1.12.11"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}