CVE-2026-5441

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5441", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-04-02T19:22:35.863Z", "datePublished": "2026-04-09T14:42:04.597Z", "dateUpdated": "2026-04-14T16:35:04.748Z"}, "containers": {"cna": {"title": "Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)", "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Orthanc", "product": "DICOM Server", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.12.10", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "references": [{"url": "https://www.orthanc-server.com/"}, {"url": "https://www.machinespirits.de/"}, {"url": "https://kb.cert.org/vuls/id/536588"}], "x_generator": {"engine": "VINCE 3.0.35", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-5441"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-04-09T14:42:04.597Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T15:07:23.792857Z", "id": "CVE-2026-5441", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T16:35:04.748Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5441", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:07:23.792857Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:07:18.474Z"}}], "cna": {"title": "Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Orthanc", "product": "DICOM Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.12.10"}]}], "references": [{"url": "https://www.orthanc-server.com/"}, {"url": "https://www.machinespirits.de/"}, {"url": "https://kb.cert.org/vuls/id/536588"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.35", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-5441"}, "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-04-09T14:42:04.597Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5441", "state": "PUBLISHED", "dateUpdated": "2026-04-14T16:35:04.748Z", "dateReserved": "2026-04-02T19:22:35.863Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-04-09T14:42:04.597Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "DICOM Server", "vendor": "Orthanc", "versions": [{"lessThanOrEqual": "1.12.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*", "matchCriteriaId": "A259075D-8B77-4B04-BC42-3E5ABE9DFE1F", "versionEndExcluding": "1.12.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output."}, {"lang": "es", "value": "Existe una vulnerabilidad de lectura fuera de l\u00edmites en la funci\u00f3n \u2019DecodePsmctRle1\u2019 de \u2019DicomImageDecoder.cpp\u2019. La rutina de descompresi\u00f3n \u2019PMSCT_RLE1\u2019, que decodifica el formato de compresi\u00f3n propietario de Philips, no valida correctamente los marcadores de escape colocados cerca del final del flujo de datos comprimidos. Una secuencia manipulada al final del b\u00fafer puede hacer que el decodificador lea m\u00e1s all\u00e1 de la regi\u00f3n de memoria asignada y filtre datos del mont\u00f3n en la salida de la imagen renderizada."}], "id": "CVE-2026-5441", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5441", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T15:07:23.792857Z", "version": "2.0.3"}}]}, "published": "2026-04-09T15:16:16.443", "references": [{"source": "cret@cert.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://kb.cert.org/vuls/id/536588"}, {"source": "cret@cert.org", "tags": ["Not Applicable"], "url": "https://www.machinespirits.de/"}, {"source": "cret@cert.org", "tags": ["Product"], "url": "https://www.orthanc-server.com/"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.12.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DICOM Server", "source": "cna", "vendor": "Orthanc"}, "product": "dicom_server", "vendor": "orthanc"}], "analysis": {"en": {"generated_at": "2026-04-15T22:35:33.869167+00:00", "value": {"mitigation_remediation": ["Check the Orthanc website or vendor portals for an update that addresses this decoding issue and apply the released patch. ", "If no patch has been released, consider upgrading to a newer Orthanc release that eliminates the flaw. ", "Implement network or file\u2011level controls to restrict DICOM uploads to trusted clients and enforce size limits to reduce the likelihood of successful exploitation."], "summary": {"action": "Patch Now", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Orthanc\u2019s DICOM Server software is affected. All builds that include the DecodePsmctRle1 routine are vulnerable, and the CVE entry does not restrict the version window, implying that current releases with PMSCT_RLE1 support are at risk.", "description_and_impact": "An out-of-bounds read occurs in the DecodePsmctRle1 routine of Orthanc\u2019s DICOM image decoder. This is a CWE-125 vulnerability. The routine, used for Philips proprietary RLE1 compression, fails to validate escape markers near the stream\u2019s end, allowing a specially crafted sequence to cause the decoder to read beyond its allocated buffer. This read can leak adjacent heap memory into the rendered image, exposing potentially sensitive data that resides near the buffer.", "risk_and_exploitability": "The flaw carries a CVSS score of 7.1, indicating moderate to high severity, while its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting low exploitation likelihood at this time. The likely attack vector is inferred to be the network interface that accepts DICOM uploads; an attacker would need to supply a malicious DICOM file containing a crafted PMSCT_RLE1 payload. If processed, the attacker could read memory contents and potentially obtain confidential information."}}}}, "created": "2026-04-10T08:53:29.681467+00:00", "updated": "2026-04-15T22:45:16.434298+00:00", "vendors": ["orthanc", "orthanc$PRODUCT$dicom_server"]}