Vulnerability Description
A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images. Pixel length validation uses 32-bit multiplication for width and height calculations. If these values overflow, the validation check incorrectly succeeds, allowing the decoder to read and write to memory beyond allocated buffers.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Orthanc-Server | Orthanc | < 1.12.11 |
Related Weaknesses (CWE)
References
- https://kb.cert.org/vuls/id/536588Third Party AdvisoryVDB Entry
- https://www.machinespirits.de/Not Applicable
- https://www.orthanc-server.com/Product
FAQ
What is CVE-2026-5443?
CVE-2026-5443 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images. Pixel length validation uses 32-bit multiplication for width and height calculations. If these values o...
How severe is CVE-2026-5443?
CVE-2026-5443 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-5443?
Check the references section above for vendor advisories and patch information. Affected products include: Orthanc-Server Orthanc.