CVE-2026-5443
Heap Buffer Overflow in DICOM PALETTE COLOR Image Decoder
Publication date: 2026-04-09
Last updated on: 2026-04-14
Assigner: CERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| orthanc-server | orthanc | to 1.12.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap buffer overflow that occurs when decoding PALETTE COLOR DICOM images. The issue arises because the pixel length validation uses 32-bit multiplication to calculate the width and height. If these calculations overflow, the validation check mistakenly passes, which allows the decoder to read and write beyond the allocated memory buffers.
How can this vulnerability impact me? :
The vulnerability can lead to memory corruption by allowing the decoder to access memory outside of the intended buffer. This can cause application crashes, data corruption, or potentially allow an attacker to execute arbitrary code, compromising the security and stability of the affected system.