CVE-2026-5442— Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions
Quick assessment
Affected
Orthanc DICOM Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Orthanc是Orthanc公司的一款免费的开源软件。 Orthanc存在安全漏洞，该漏洞源于DICOM图像解码器存在堆缓冲区溢出，可能导致整数溢出并在图像解码期间产生越界内存访问。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-5442
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions
Source: CVE Program / CVE List V5
Vulnerability Description
A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimension fields are encoded using Value Representation (VR) Unsigned Long (UL), instead of the expected VR Unsigned Short (US), which allows extremely large dimensions to be processed. This causes an integer overflow during frame size calculation and results in out-of-bounds memory access during image decoding.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Orthanc 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Orthanc是Orthanc公司的一款免费的开源软件。 Orthanc存在安全漏洞，该漏洞源于DICOM图像解码器存在堆缓冲区溢出，可能导致整数溢出并在图像解码期间产生越界内存访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Orthanc | DICOM Server | 0 ~ 1.12.10 | - |
|
II. Public POCs for CVE-2026-5442
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5442
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-5442 (1)
Same Patch Batch · Orthanc · 2026-04-09 · 9 CVEs total
| CVE-2026-5444 | Heap Buffer Overflow in PAM Image Buffer Allocation | |
| CVE-2026-5441 | Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression) | |
| CVE-2026-5445 | Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable) | |
| CVE-2026-5440 | Memory Exhaustion via Unbounded Content-Length | |
| CVE-2026-5443 | Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode) | |
| CVE-2026-5438 | Gzip Decompression Bomb via Content-Encoding Header | |
| CVE-2026-5439 | Memory Exhaustion via Forged ZIP Metadata | |
| CVE-2026-5437 | Out-of-Bounds Read in DicomStreamReader |
IV. Related Vulnerabilities
Same product: DICOM Server
-
CVE-2026-10528
Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-ba -
CVE-2026-5439
Memory Exhaustion via Forged ZIP Metadata -
CVE-2026-5437
Out-of-Bounds Read in DicomStreamReader -
CVE-2026-5438
Gzip Decompression Bomb via Content-Encoding Header -
CVE-2026-5440
Memory Exhaustion via Unbounded Content-Length
Same vendor: Orthanc
-
CVE-2026-10528
Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-ba -
CVE-2026-10173
Orthanc Explorer 2 URL StudyList.vue cross site scripting -
CVE-2026-5439
Memory Exhaustion via Forged ZIP Metadata -
CVE-2026-5437
Out-of-Bounds Read in DicomStreamReader -
CVE-2026-5438
Gzip Decompression Bomb via Content-Encoding Header
V. Comments for CVE-2026-5442
No comments yet