Heap Buffer Overflow Vulnerability in DICOM Image Decoder by Orthanc

CVE-2026-5442

What is CVE-2026-5442?

A heap buffer overflow vulnerability exists in the DICOM image decoder used by Orthanc, where dimension fields are improperly encoded as Value Representation (VR) Unsigned Long (UL) instead of the expected VR Unsigned Short (US). This misconfiguration allows large dimension values to be processed, leading to an integer overflow during frame size calculations. Consequently, this results in out-of-bounds memory access, which could potentially be exploited to execute arbitrary code or crash the application.

References