Integer Overflow Vulnerability in Orthanc DICOM Server by Orthanc
CVE-2026-87020

7.2HIGH

Key Information:

Vendor

Orthanc

Status
Dicom Server
Vendor
CVE Published:
11 September 2026

What is CVE-2026-87020?

An integer overflow vulnerability exists in the pitch and buffer-size computations when Orthanc DICOM Server processes attacker-supplied PNG files. This flaw can trigger a heap out-of-bounds write, leading to potential arbitrary code execution or denial of service, making it imperative for users to assess their systems' security.

Affected Version(s)

DICOM Server 0 < 1.13.0

DICOM Server 1.13.0

References

https://orthanc.uclouvain.be/downloads/index.html
https://www.cisa.gov/news-events/ics-medical-advisories/i...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrej Tomci reported this vulnerability to CISA.
.