CVE-2026-5444: falha de alta gravidade em Orthanc DICOM Server
Heap Buffer Overflow in PAM Image Buffer Allocation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic. Specially chosen values can cause an integer overflow during buffer size calculation, resulting in the allocation of a small buffer followed by a much larger write operation during pixel processing.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Produtos afetados
Orthanc · DICOM ServerCVEs relacionadas — Orthanc DICOM Server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-5445CRITICALOut-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)EPSS 0.7%CVE-2026-5437HIGHOut-of-Bounds Read in DicomStreamReaderEPSS 0.7%CVE-2026-5442CRITICALHeap Buffer Overflow in DICOM Image Decoder via VR UL DimensionsEPSS 0.6%CVE-2026-5440HIGHMemory Exhaustion via Unbounded Content-LengthEPSS 0.6%CVE-2026-5443CRITICALHeap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)EPSS 0.6%CVE-2026-87020HIGHOrthanc DICOM Server Integer Overflow or WraparoundEPSS 0.6%