Log in Start free

Vulnerability · Published Apr 9, 2026 · Assigned by certcc

CVE-2026-5444Heap Buffer Overflow in PAM Image Buffer Allocation

High 7.1

In plain English

A high-severity security flaw in DICOM Server from Orthanc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 94.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic. Specially chosen values can cause an integer overflow during buffer size calculation, resulting in the allocation of a small buffer followed by a much larger write operation during pixel processing.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12orthancno fix listedDEBIAN-CVE-2026-5444
Debian:13orthancno fix listedDEBIAN-CVE-2026-5444
Debian:14orthanc1.12.10+dfsg-4DEBIAN-CVE-2026-5444
Ubuntu:22.04:LTSorthancno fix listedUBUNTU-CVE-2026-5444
Ubuntu:24.04:LTSorthancno fix listedUBUNTU-CVE-2026-5444
Ubuntu:25.10orthancno fix listedUBUNTU-CVE-2026-5444
Ubuntu:26.04:LTSorthancno fix listedUBUNTU-CVE-2026-5444
Ubuntu:26.10orthancno fix listedUBUNTU-CVE-2026-5444

Affected products (as reported)

VendorProductVersions
Orthanc DICOM Server 0 – through 1.12.10

References