CVE-2026-5445

An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.cert.org/vuls/id/536588	Third Party Advisory VDB Entry
https://www.machinespirits.de/	Not Applicable
https://www.orthanc-server.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de lectura fuera de límites en la función ’DecodeLookupTable’ dentro de ’DicomImageDecoder.cpp’. La lógica de decodificación de tabla de búsqueda utilizada para imágenes ’PALETTE COLOR’ no valida los índices de píxeles contra el tamaño de la tabla de búsqueda. Imágenes manipuladas que contienen índices mayores que el tamaño de la paleta hacen que el decodificador lea más allá de la memoria asignada para la tabla de búsqueda y exponga el contenido del heap en la imagen de salida.

Information

Published : 2026-04-09 15:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-5445

Mitre link : CVE-2026-5445

CVE.ORG link : CVE-2026-5445

JSON object : View

Products Affected

orthanc-server

orthanc

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-5445", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5445", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:08:58.289132Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Orthanc", "product": "DICOM Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.12.10"}]}]}], "published": "2026-04-09T15:16:16.863", "references": [{"url": "https://kb.cert.org/vuls/id/536588", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}, {"url": "https://www.machinespirits.de/", "tags": ["Not Applicable"], "source": "cret@cert.org"}, {"url": "https://www.orthanc-server.com/", "tags": ["Product"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image."}, {"lang": "es", "value": "Existe una vulnerabilidad de lectura fuera de l\u00edmites en la funci\u00f3n \u2019DecodeLookupTable\u2019 dentro de \u2019DicomImageDecoder.cpp\u2019. La l\u00f3gica de decodificaci\u00f3n de tabla de b\u00fasqueda utilizada para im\u00e1genes \u2019PALETTE COLOR\u2019 no valida los \u00edndices de p\u00edxeles contra el tama\u00f1o de la tabla de b\u00fasqueda. Im\u00e1genes manipuladas que contienen \u00edndices mayores que el tama\u00f1o de la paleta hacen que el decodificador lea m\u00e1s all\u00e1 de la memoria asignada para la tabla de b\u00fasqueda y exponga el contenido del heap en la imagen de salida."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A259075D-8B77-4B04-BC42-3E5ABE9DFE1F", "versionEndExcluding": "1.12.11"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}