CVE-2026-5441: 
NixOS vulnerability analysis and mitigation

CVE-2026-5441 is an out-of-bounds read vulnerability in the DecodePsmctRle1 function of DicomImageDecoder.cpp within the Orthanc DICOM Server. The flaw resides in the PMSCT_RLE1 decompression routine, which handles the proprietary Philips Compression format, and fails to properly validate escape markers near the end of a compressed data stream. It affects Orthanc versions up to and including 1.12.10; version 1.12.11 addresses the issue. Disclosed on April 9, 2026, by CERT/CC (VU#536588), it carries a CVSS v3.1 base score of 7.1 (High) (CERT/CC Advisory, GitHub Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). The PMSCT_RLE1 decompression routine in DicomImageDecoder.cpp does not enforce bounds checks on escape marker sequences positioned near the end of the compressed data buffer. When a crafted DICOM file containing such a sequence is processed, the decoder reads beyond the allocated memory region, leaking heap-resident data into the rendered image output. Exploitation requires local access and user interaction — specifically, a user or automated process must open or render the malicious DICOM file. A dedicated technical advisory is available from the discovering researchers (Machine Spirits Advisory, CERT/CC Advisory).

Successful exploitation can result in disclosure of sensitive heap memory contents — potentially including allocator metadata, internal identifiers, or adjacent DICOM data — embedded within the rendered image output. Availability is also impacted, as the out-of-bounds read can cause the Orthanc server process to crash. In healthcare environments, this could expose protected health information (PHI) or disrupt medical imaging workflows. The vulnerability does not directly enable integrity compromise or code execution on its own (CERT/CC Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term. Exploitation requires that a victim open or process a crafted DICOM file, limiting the attack surface to scenarios where untrusted DICOM content is ingested (GitHub Advisory).

1. Craft malicious DICOM file: Create a DICOM image file that uses the PMSCT_RLE1 (Philips Compression) transfer syntax. Embed a specially crafted escape marker sequence positioned near the very end of the compressed data buffer to trigger the out-of-bounds read in DecodePsmctRle1.
2. Deliver the file: Upload the crafted DICOM file to a vulnerable Orthanc instance (version ≤ 1.12.10) via the REST API or DICOM network protocol, or social-engineer a user/automated pipeline into processing the file.
3. Trigger image decoding: Cause the server to decode and render the malicious image — for example, by requesting a preview or thumbnail via the Orthanc REST API (e.g., GET /instances/{id}/preview).
4. Retrieve leaked heap data: Collect the rendered image output returned by the server. Heap memory contents read beyond the buffer boundary are embedded in the image pixel data, potentially exposing sensitive in-memory information (CERT/CC Advisory, Machine Spirits Advisory).

• Network: Unexpected DICOM file uploads (C-STORE or REST API POST to /instances) from untrusted or external sources; repeated requests to /instances/{id}/preview or image rendering endpoints shortly after upload.
• Logs: Orthanc server logs showing processing of DICOM files with TransferSyntaxUID corresponding to Philips PMSCT_RLE1 compression from unknown or external sources; crash or segmentation fault entries in Orthanc logs.
• File System: Presence of unexpected DICOM files with Philips proprietary transfer syntax in the Orthanc storage directory originating from untrusted sources.
• Process: Abnormal termination or restart of the Orthanc process following image decode operations (CERT/CC Advisory).

Orthanc has released version 1.12.11 to address CVE-2026-5441 and all related vulnerabilities in VU#536588; users should upgrade immediately (CERT/CC Advisory). As an interim measure, administrators should restrict access to Orthanc's upload and image processing endpoints to trusted users and networks only, and avoid processing DICOM files from untrusted sources. Disabling or filtering PMSCT_RLE1 (Philips Compression) DICOM content at the network perimeter can further reduce exposure until patching is complete.

The vulnerability was discovered and responsibly disclosed by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG, who published dedicated technical advisories for each of the nine Orthanc vulnerabilities (CERT/CC Advisory). Security news outlets including News4Hackers and Rescana covered the broader set of Orthanc DICOM vulnerabilities, highlighting the risk to healthcare systems from potential crashes and remote code execution in the related heap overflow issues. Red Hat also tracked the CVE, indicating relevance to Linux distribution maintainers (Red Hat CVE). Community discussion was limited, consistent with the low EPSS score and absence of public exploits.