Vulnerability · Published Apr 9, 2026 · Assigned by certcc
CVE-2026-5441Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)
High 7.1
In plain English
A high-severity security flaw in DICOM Server from Orthanc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | orthanc | no fix listed | DEBIAN-CVE-2026-5441 |
| Debian:13 | orthanc | no fix listed | DEBIAN-CVE-2026-5441 |
| Debian:14 | orthanc | 1.12.10+dfsg-4 | DEBIAN-CVE-2026-5441 |
| Ubuntu:22.04:LTS | orthanc | no fix listed | UBUNTU-CVE-2026-5441 |
| Ubuntu:24.04:LTS | orthanc | no fix listed | UBUNTU-CVE-2026-5441 |
| Ubuntu:25.10 | orthanc | no fix listed | UBUNTU-CVE-2026-5441 |
| Ubuntu:26.04:LTS | orthanc | no fix listed | UBUNTU-CVE-2026-5441 |
| Ubuntu:26.10 | orthanc | no fix listed | UBUNTU-CVE-2026-5441 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Orthanc | DICOM Server | 0 – through 1.12.10 |