Vulnerability details

CVE-2026-5437

Orthanc DICOM Server

Out-of-Bounds Read in DicomStreamReader

CVSS 3.1
7.5High

Official description

An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing. When processing malformed metadata structures, the parser may read beyond the bounds of the allocated metadata buffer. Although this issue does not typically crash the server or expose data directly to the attacker, it reflects insufficient input validation in the parsing logic.

CVSS scores

ScoreVersionSourceVector
7.5High 3.1 CISA ADP / Vulnrichment (CISA-ADP) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersionsSource
Orthanc DICOM Server v ≤ 1.12.10 CVEProject cvelistV5 (CNA)

References and advisories

3
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-04-09
Last updated
2026-04-14
State
Published
Assigner (CNA)
certcc

Exploit prediction (EPSS)

0.65%
Probability of exploitation in 30 days
51.4%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • —