Vulnerability · Published Apr 9, 2026 · Assigned by certcc
CVE-2026-5437Out-of-Bounds Read in DicomStreamReader
High 7.5
In plain English
A high-severity security flaw in DICOM Server from Orthanc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 48.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing. When processing malformed metadata structures, the parser may read beyond the bounds of the allocated metadata buffer. Although this issue does not typically crash the server or expose data directly to the attacker, it reflects insufficient input validation in the parsing logic.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | orthanc | no fix listed | DEBIAN-CVE-2026-5437 |
| Debian:13 | orthanc | no fix listed | DEBIAN-CVE-2026-5437 |
| Debian:14 | orthanc | 1.12.10+dfsg-4 | DEBIAN-CVE-2026-5437 |
| Ubuntu:22.04:LTS | orthanc | no fix listed | UBUNTU-CVE-2026-5437 |
| Ubuntu:24.04:LTS | orthanc | no fix listed | UBUNTU-CVE-2026-5437 |
| Ubuntu:25.10 | orthanc | no fix listed | UBUNTU-CVE-2026-5437 |
| Ubuntu:26.04:LTS | orthanc | no fix listed | UBUNTU-CVE-2026-5437 |
| Ubuntu:26.10 | orthanc | no fix listed | UBUNTU-CVE-2026-5437 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Orthanc | DICOM Server | 0 – through 1.12.10 |