External risk intelligence

Orthanc DICOM Image Heap Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-5443

The vulnerability exists in Orthanc, a DICOM server typically used within internal medical imaging networks. While Orthanc instances can be exposed to the internet to facilitate remote access or image sharing, they are often deployed behind firewalls or within secure, isolated hospital environments. As such, internet-facing exposure is plausible in some configurations but not the universal default deployment pattern.

Out-of-bounds Write

Orthanc Server Orthanc

before 1.12.11

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a component used for decoding specific image formats, potentially allowing unauthorized access to memory. This issue could enable attackers to read or write sensitive data beyond allocated buffers, impacting the integrity and confidentiality of information processed by affected systems.

Image data decoding allows memory corruption.
Critical flaw could compromise data confidentiality.
Confirm relevance and assess exposure impact.

Attack Path

How an attacker could exploit the issue

An attacker can trigger a critical vulnerability by sending a specially crafted `PALETTE COLOR` DICOM image file. This file exploits a flaw in how the software calculates pixel data sizes, leading to a buffer overflow when processing the image. The vulnerability can allow an attacker to read and write to unintended memory locations, potentially leading to system compromise.

No special access required.
Triggered by a malicious DICOM image.
Enables arbitrary memory read/write.

Live Threat

Current exploitation, exposure, and threat context

A heap buffer overflow vulnerability in DICOM image decoding could allow an attacker to read and write to memory beyond allocated buffers. This occurs when the pixel length validation fails due to a 32-bit multiplication overflow when calculating image dimensions, potentially leading to code execution.

DICOM image decoding memory.
Overflow during pixel length calculation.
Remote code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Orthanc's DICOM image decoding impacts application owners and infrastructure teams responsible for imaging data management. The immediate priority is to locate all instances of the affected Orthanc server, determine their exposure and criticality, identify the system owner, and then plan remediation activities, potentially involving vendor coordination.

Application and infrastructure teams own remediation.
Verify Orthanc server exposure and criticality first.
Plan remediation with vendor and system owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Orthanc and how is it used?

Orthanc is a lightweight, open-source DICOM server software widely used in medical settings to store, manage, and share diagnostic medical images. It functions as a central repository for imaging data, allowing healthcare systems to organize and access files across different medical devices and workstations.

What does CWE-787 mean regarding CVE-2026-5443?

CWE-787 represents an Out-of-bounds Write vulnerability, often called a heap buffer overflow. In this case, when the software processes certain DICOM image dimensions, a math error causes it to miscalculate the necessary memory space. This allows data to be written outside of the intended memory area, which can corrupt system operations.

How is this heap buffer overflow triggered?

The vulnerability is triggered when the system attempts to decode a specifically crafted PALETTE COLOR DICOM image file. It is not triggered by standard, well-formed medical images. The flaw relies on providing dimensions that cause a 32-bit integer overflow during validation, bypassing the software's memory safety checks.

Is my Orthanc server at risk?

According to Halo Surface Signal, risk depends heavily on your deployment. While Orthanc is typically used within secure, internal medical networks, some instances may be exposed to the internet for remote access. If your server is reachable from the internet, it faces a higher likelihood of encountering malicious DICOM files compared to those isolated behind firewalls.

What should I do to address this CVE?

First, identify all running instances of Orthanc within your infrastructure to determine which versions are in use. Check if your current version is earlier than 1.12.11, as this version contains the fix. Coordinate with your system owners to prioritize updating these servers and assess whether any internet-facing instances can be moved to a more restricted network.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.