Out-of-Bounds Read Vulnerability in Orthanc Server's Dicom Image Decoder

CVE-2026-5445

What is CVE-2026-5445?

A vulnerability exists in the DicomImageDecoder.cpp module of Orthanc Server, specifically within the DecodeLookupTable function. This issue arises when the decoding logic for PALETTE COLOR images fails to properly validate pixel indices against the available size of the lookup table. As a result, specifically crafted images can exploit this flaw by using indices that exceed the palette size, leading to the decoder reading beyond the allocated memory for the lookup table. This misstep exposes sensitive memory content within the heap in the output image, potentially allowing unauthorized access to sensitive information.

References