Memory Exhaustion Vulnerability in Orthanc by Machine Spirits

CVE-2026-5439

What is CVE-2026-5439?

A memory exhaustion vulnerability has been identified in the ZIP archive processing feature of Orthanc. This flaw arises when Orthanc automatically extracts uploaded ZIP archives, relying on metadata that specifies the uncompressed size of files. An attacker can exploit this by creating a specially crafted ZIP archive with a manipulated size value, leading the server to allocate disproportionately large buffers during extraction. This can result in resource depletion, affecting server stability and availability. It is essential for users and administrators of Orthanc to implement the latest security updates to mitigate this risk.

References