CVE-2026-5445

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5445", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-04-02T19:23:30.637Z", "datePublished": "2026-04-09T14:42:51.673Z", "dateUpdated": "2026-04-14T16:34:52.024Z"}, "containers": {"cna": {"title": "Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)", "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Orthanc", "product": "DICOM Server", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.12.10", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "references": [{"url": "https://www.orthanc-server.com/"}, {"url": "https://www.machinespirits.de/"}, {"url": "https://kb.cert.org/vuls/id/536588"}], "x_generator": {"engine": "VINCE 3.0.35", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-5445"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-04-09T14:42:51.673Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T15:08:58.289132Z", "id": "CVE-2026-5445", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T16:34:52.024Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5445", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:08:58.289132Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:08:50.270Z"}}], "cna": {"title": "Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Orthanc", "product": "DICOM Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.12.10"}]}], "references": [{"url": "https://www.orthanc-server.com/"}, {"url": "https://www.machinespirits.de/"}, {"url": "https://kb.cert.org/vuls/id/536588"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.35", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-5445"}, "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-04-09T14:42:51.673Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5445", "state": "PUBLISHED", "dateUpdated": "2026-04-14T16:34:52.024Z", "dateReserved": "2026-04-02T19:23:30.637Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-04-09T14:42:51.673Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "DICOM Server", "vendor": "Orthanc", "versions": [{"lessThanOrEqual": "1.12.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*", "matchCriteriaId": "A259075D-8B77-4B04-BC42-3E5ABE9DFE1F", "versionEndExcluding": "1.12.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image."}, {"lang": "es", "value": "Existe una vulnerabilidad de lectura fuera de l\u00edmites en la funci\u00f3n \u2019DecodeLookupTable\u2019 dentro de \u2019DicomImageDecoder.cpp\u2019. La l\u00f3gica de decodificaci\u00f3n de tabla de b\u00fasqueda utilizada para im\u00e1genes \u2019PALETTE COLOR\u2019 no valida los \u00edndices de p\u00edxeles contra el tama\u00f1o de la tabla de b\u00fasqueda. Im\u00e1genes manipuladas que contienen \u00edndices mayores que el tama\u00f1o de la paleta hacen que el decodificador lea m\u00e1s all\u00e1 de la memoria asignada para la tabla de b\u00fasqueda y exponga el contenido del heap en la imagen de salida."}], "id": "CVE-2026-5445", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5445", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T15:08:58.289132Z", "version": "2.0.3"}}]}, "published": "2026-04-09T15:16:16.863", "references": [{"source": "cret@cert.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://kb.cert.org/vuls/id/536588"}, {"source": "cret@cert.org", "tags": ["Not Applicable"], "url": "https://www.machinespirits.de/"}, {"source": "cret@cert.org", "tags": ["Product"], "url": "https://www.orthanc-server.com/"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.12.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DICOM Server", "source": "cna", "vendor": "Orthanc"}, "product": "dicom_server", "vendor": "orthanc"}], "analysis": {"en": {"generated_at": "2026-04-15T19:38:06.960822+00:00", "value": {"mitigation_remediation": ["Upgrade Orthanc to the latest release that addresses the DecodeLookupTable out\u2011of\u2011bounds read.", "If an upgrade cannot be performed immediately, restrict the server to deny or reject DICOM files that use Palette Color images or perform manual validation of pixel indices before decoding.", "Check the Orthanc security advisories and contact Orthanc support for the exact patch version if the current release is uncertain."], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Orthanc DICOM Server is the affected product. No specific affected version list is provided, so any release containing the vulnerable DecodeLookupTable implementation may be at risk. Users should consult the Orthanc changelog or security advisories for confirmation of a fix.", "description_and_impact": "The vulnerability lies in the DecodeLookupTable function used for Palette Color DICOM images; the function does not validate pixel indices against the size of the lookup table, allowing an attacker to craft a DICOM file with indices that exceed the table bounds. When the server decodes such a file it performs an out\u2011of\u2011bounds read, leaking heap memory contents into the output image. This can expose sensitive data and may serve as a side channel for more advanced attacks. The weakness maps to buffer overread (CWE\u2011125).", "risk_and_exploitability": "The CVSS base score of 9.1 denotes a high\u2011severity issue that can lead to information disclosure. The EPSS score of less than 1\u00a0% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA\u2019s KEV catalog. The flaw can be triggered by a maliciously crafted DICOM file sent to the server; the attack vector is thus likely remote from a client that transmits such a file. No privileged host access is required, making exploitation straightforward once the file reaches the server."}}}}, "created": "2026-04-10T08:53:27.764502+00:00", "updated": "2026-04-15T19:45:12.725990+00:00", "vendors": ["orthanc", "orthanc$PRODUCT$dicom_server"]}