What’s Vulnerable › Vulnerabilities

CVE-2026-5444: Heap Buffer Overflow in PAM Image Buffer Allocation

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-10-26
• Weakness: CWE-787

Description

A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic. Specially chosen values can cause an integer overflow during buffer size calculation, resulting in the allocation of a small buffer followed by a much larger write operation during pixel processing.

Affected products

• orthanc-server orthanc: before 1.12.11 — fixed in 1.12.11

How to fix

Upgrade to a fixed version: orthanc-server orthanc 1.12.11. Check the vendor advisory for mitigations.

References

• https://kb.cert.org/vuls/id/536588
• https://www.machinespirits.de/
• https://www.orthanc-server.com/

Get alerted when CVE-2026-5444 or the next vulnerability affects your stack