CVE-2026-5441

Received Received - Intake

Out-of-Bounds Read in Philips PMSCT_RLE1 Decoder Leaks Heap Data

Publication date: 2026-04-09

Last updated on: 2026-04-14

Assigner: CERT/CC

Description

An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-14

Generated

2026-07-06

AI Q&A

2026-04-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-5441

EUVD

EUVD-2026-20918

Affected Vendors & Products

Vendor	Product	Version / Range
orthanc-server	orthanc	to 1.12.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to leakage of heap memory data into the rendered image output when decoding images compressed with the Philips Compression format.

This could expose sensitive or confidential data that resides in memory, potentially leading to information disclosure.

Executive Summary

This vulnerability is an out-of-bounds read in the DecodePsmctRle1 function of DicomImageDecoder.cpp. Specifically, the PMSCT_RLE1 decompression routine, which handles the proprietary Philips Compression format, fails to properly validate escape markers near the end of the compressed data stream.

Because of this improper validation, a specially crafted sequence placed at the end of the buffer can cause the decoder to read memory beyond the allocated region.

This results in leaking heap data into the rendered image output.

Hi! I’m here to help you understand CVE-2026-5441. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70