External risk intelligence

Orthanc Out-of-Bounds Read in DICOM Decoder Exposes Heap Contents

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-5445

The vulnerability exists in a medical imaging decoder within the Orthanc server. While the software can be deployed as an internet-facing DICOM or web server, many instances are deployed within internal clinical or research networks to process diagnostic images. As usage spans both protected internal environments and public-facing imaging portals, internet reachability is plausible but not the default or exclusive deployment pattern.

Out-of-bounds Read

Orthanc Server Orthanc

before 1.12.11

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Orthanc medical imaging server could allow attackers to read sensitive information from memory by supplying specially crafted image files. This issue lies within the image decoding component, where pixel data is not properly validated against the lookup table size, potentially leading to the exposure of heap contents.

Specially crafted images can expose sensitive memory.
Medical imaging servers are the affected technology.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could send a specially crafted DICOM image file to a vulnerable Orthanc server. The server's image decoding function, specifically when processing `PALETTE COLOR` images, fails to properly check the size of pixel indices against the lookup table. This leads to an out-of-bounds read, potentially exposing sensitive heap memory contents within the processed image.

Requires an unauthenticated network connection.
Triggered by processing a malicious image.
Risks memory disclosure and potential denial of service.

Live Threat

Current exploitation, exposure, and threat context

A crafted DICOM image could cause the `DicomImageDecoder` to read beyond allocated memory, exposing heap contents within the output image. This may occur when processing `PALETTE COLOR` images if the pixel indices are not properly validated against the lookup table size.

Exposure of heap memory.
When processing specially crafted images.
May lead to information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for managing this vulnerability within the Orthanc server. The first practical step is to identify all deployed instances of the affected technology, confirm their reachability and business criticality, and then locate the accountable owner to plan remediation based on assessed risk.

Identify accountable application owners.
Verify asset reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Orthanc software affected by CVE-2026-5445?

Orthanc is a lightweight, open-source server designed for managing medical imaging data. It is widely used in clinical and research environments to store, retrieve, and process files in the DICOM format, which is the standard for medical images like X-rays and MRI scans.

What does this out-of-bounds read vulnerability mean?

This is a memory safety issue, specifically classified as CWE-125. When the software decodes certain DICOM images, it fails to check if the pixel data fits within the allowed memory boundaries. Because it does not validate these indices, the software reads past the intended memory, potentially leaking sensitive data from the server's heap into the processed image.

How is this vulnerability triggered?

An attacker triggers this by submitting a specially crafted image file to the Orthanc server. The bug specifically affects the processing of PALETTE COLOR images where pixel indices exceed the predefined lookup table size. Simply browsing the server or performing standard administrative tasks without processing these malicious image files does not trigger the vulnerability.

Who should be concerned about CVE-2026-5445?

Anyone managing an Orthanc server instance should assess their risk. According to Halo Surface Signal, while Orthanc is frequently used in protected internal clinical or research networks, it can also be configured as an internet-facing portal. If your instance is reachable from the internet, the potential for unauthorized access is higher compared to deployments isolated within a private network.

How do I respond to this threat?

Begin by identifying all running instances of Orthanc within your environment. Once you have a complete inventory, verify whether each server is accessible via the internet or restricted to internal traffic. Determine the business criticality of each instance and coordinate with the application owners to plan for updates to a version that addresses the decoding flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.