Heap Buffer Overflow Vulnerability in Orthanc by Team Machine Spirits

CVE-2026-5444

What is CVE-2026-5444?

A heap buffer overflow vulnerability is present in the image parsing logic of Orthanc, specifically when processing PAM images embedded within DICOM files. The vulnerability arises as crafted images trigger integer overflows during buffer size calculations due to improper handling of image dimensions using 32-bit unsigned arithmetic. This can lead to the allocation of insufficient buffers, followed by excessive write operations during pixel processing, potentially resulting in application crashes or exploitation opportunities.

References