What’s Vulnerable › Vulnerabilities

CVE-2026-5441: Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-10-26
• Weakness: CWE-125

Description

An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output.

Affected products

• orthanc-server orthanc: before 1.12.11 — fixed in 1.12.11

How to fix

Upgrade to a fixed version: orthanc-server orthanc 1.12.11. Check the vendor advisory for mitigations.

References

• https://kb.cert.org/vuls/id/536588
• https://www.machinespirits.de/
• https://www.orthanc-server.com/

Get alerted when CVE-2026-5441 or the next vulnerability affects your stack