Vulnerability Description
A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic. Specially chosen values can cause an integer overflow during buffer size calculation, resulting in the allocation of a small buffer followed by a much larger write operation during pixel processing.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Orthanc-Server | Orthanc | < 1.12.11 |
Related Weaknesses (CWE)
References
- https://kb.cert.org/vuls/id/536588Third Party AdvisoryVDB Entry
- https://www.machinespirits.de/Not Applicable
- https://www.orthanc-server.com/Product
FAQ
What is CVE-2026-5444?
CVE-2026-5444 is a vulnerability with a CVSS score of 7.1 (HIGH). A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned a...
How severe is CVE-2026-5444?
CVE-2026-5444 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-5444?
Check the references section above for vendor advisories and patch information. Affected products include: Orthanc-Server Orthanc.