External risk intelligence

DICOM Decoder Heap Buffer Overflow in Orthanc Server.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-5442

The vulnerability exists in the DICOM image decoder of the Orthanc server. While Orthanc is often deployed as a backend medical imaging server within internal hospital networks, it can be configured to expose its REST API or web interface to the public internet or broader networks for remote access, making internet reachability possible depending on the specific deployment.

Out-of-bounds Write

Orthanc Server Orthanc

before 1.12.11

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the DICOM image decoding component of the Orthanc server, potentially allowing for unauthorized access and manipulation of medical image data. This issue stems from an incorrect handling of image dimensions, which can lead to memory corruption during the decoding process.

Improper image dimension handling allows memory access.
Critical vulnerability impacts medical imaging server.
Confirm exposure and relevance for critical systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted DICOM image to a vulnerable Orthanc server. The server's DICOM image decoder improperly handles extremely large dimension values within the image data, leading to an integer overflow and a heap buffer overflow. This out-of-bounds memory write can be leveraged to corrupt memory, potentially allowing for the execution of arbitrary code.

Requires network exposure.
Triggered by malformed DICOM images.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A heap buffer overflow vulnerability in the DICOM image decoder could allow an attacker to cause an out-of-bounds memory access when processing extremely large image dimensions. This could affect the availability and integrity of the image decoding service.

DICOM image decoding service.
Processing malformed DICOM files.
Service may become unavailable or unstable.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Orthanc server's DICOM decoder is vulnerable to a heap buffer overflow due to improper handling of dimension fields, potentially allowing for out-of-bounds memory access. Owners of the Orthanc product and the infrastructure teams managing its deployment are likely responsible for addressing this. The initial practical step involves identifying all instances of the affected Orthanc server, assessing their network reachability and business criticality, and then engaging the appropriate teams for remediation planning.

Own the issue: Application and Infrastructure owners.
Verify first: Orthanc server instances and reachability.
Action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Orthanc server used for?

Orthanc is a lightweight, open-source vendor-neutral archive designed for medical imaging. It acts as a central repository where hospitals and clinics store, manage, and share DICOM files—the industry standard for medical images like X-rays and MRI scans. By providing a REST API, it allows applications to programmatically interact with and retrieve imaging data.

What does CVE-2026-5442 mean in plain English?

This is a heap buffer overflow vulnerability, categorized as CWE-787. In the DICOM decoder, the software incorrectly processes image dimensions, leading to an integer overflow. When the system then attempts to allocate memory based on these corrupted values, it writes data outside of its intended boundaries. This memory corruption can potentially allow an attacker to disrupt the service or gain unauthorized control over the server.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted, malformed DICOM image file to the Orthanc server. The flaw specifically relies on the decoder failing to handle extremely large, invalid dimension fields. Simply having the server installed or running typical, well-formed medical images does not trigger the bug; the system must process a file specifically designed to exploit the dimension field error.

Is my Orthanc instance at risk?

Risk depends on how you have deployed the software. According to Halo Surface Signal, while Orthanc is typically used within internal hospital networks, it may be reachable if the REST API or web interface is exposed to the broader internet. If your server is accessible from outside your local network, it is at higher risk of being targeted by this flaw compared to isolated, internal-only deployments.

What are the first steps to take?

Begin by auditing your infrastructure to locate all running instances of the Orthanc server. Determine the network reachability for each instance to prioritize those accessible from external networks. Coordinate with your application and infrastructure teams to review your current version and begin planning for an update, as ensuring your systems are on a version excluding this flaw is the recommended path for remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.