CVE-2026-5445: critical vulnerability in Orthanc DICOM Server
Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 0.7%
An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected products
Orthanc · DICOM ServerRelated CVEs — Orthanc DICOM Server
In the same product, most dangerous first.
CVE-2026-5437HIGHOut-of-Bounds Read in DicomStreamReaderEPSS 0.7%CVE-2026-5442CRITICALHeap Buffer Overflow in DICOM Image Decoder via VR UL DimensionsEPSS 0.6%CVE-2026-5440HIGHMemory Exhaustion via Unbounded Content-LengthEPSS 0.6%CVE-2026-5443CRITICALHeap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)EPSS 0.6%CVE-2026-87020HIGHOrthanc DICOM Server Integer Overflow or WraparoundEPSS 0.6%CVE-2026-5438HIGHGzip Decompression Bomb via Content-Encoding HeaderEPSS 0.5%