CVE-2026-5445

Received Received - Intake

Out-of-Bounds Read in DicomImageDecoder Palette Color Processing

Publication date: 2026-04-09

Last updated on: 2026-04-14

Assigner: CERT/CC

Description

An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-14

Generated

2026-07-06

AI Q&A

2026-04-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-5445

EUVD

EUVD-2026-20926

Affected Vendors & Products

Vendor	Product	Version / Range
orthanc-server	orthanc	to 1.12.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in the DecodeLookupTable function within DicomImageDecoder.cpp. Specifically, the decoding logic for PALETTE COLOR images does not check if pixel indices are within the size of the lookup table. If an image is crafted with indices larger than the palette size, the decoder reads memory beyond the allocated lookup table.

As a result, the decoder may expose heap memory contents in the output image, potentially leaking sensitive data.

Impact Analysis

This vulnerability can lead to exposure of unintended memory contents through the output image, which may include sensitive or confidential data stored in heap memory.

An attacker could exploit this by providing specially crafted PALETTE COLOR images that trigger the out-of-bounds read, potentially leading to information disclosure.

Hi! I’m here to help you understand CVE-2026-5445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70