CVE-2026-5442: 
NixOS vulnerability analysis and mitigation

CVE-2026-5442 is a heap buffer overflow vulnerability in the DICOM image decoder of Orthanc, an open-source DICOM server widely used in healthcare environments. The flaw arises because image dimension fields are encoded using Value Representation (VR) Unsigned Long (UL) instead of the expected Unsigned Short (US), permitting extremely large dimension values to be processed. This leads to an integer overflow during frame size calculation and subsequent out-of-bounds memory access during image decoding. All Orthanc versions prior to 1.12.11 are affected. It was disclosed on April 9, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (CERT/CC Advisory, Github Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write), stemming from unsafe arithmetic in the DICOM image decoder within DicomImageDecoder.cpp. When processing DICOM image files, the decoder reads dimension fields (width/height) using VR UL, which allows 32-bit unsigned values far exceeding the valid DICOM range for image dimensions (normally constrained to VR US, 16-bit). The oversized dimensions cause an integer overflow when computing the frame buffer size, resulting in allocation of an undersized buffer followed by an out-of-bounds write during pixel data processing. The vulnerability is exploitable remotely over the network without authentication or user interaction, simply by submitting a crafted DICOM file to the server's image processing endpoint. A dedicated technical advisory is available from the discovering researchers (CERT/CC Advisory, Machine Spirits Advisory).

Successful exploitation can result in heap memory corruption, which may lead to denial of service (process crash), information disclosure of heap-resident data, or potentially remote code execution under certain conditions. Because Orthanc is deployed in healthcare environments to store and process medical imaging data, exploitation could disrupt clinical operations, expose sensitive patient imaging data, or allow an attacker to gain a foothold on the server for lateral movement within the healthcare network. The CERT/CC advisory notes that malicious DICOM content can be stored and later re-triggered during normal processing, increasing the persistence and operational impact of exploitation (CERT/CC Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability requires no authentication and no user interaction, making it trivially exploitable by any network-accessible attacker who can submit DICOM files to the server. The EPSS score is approximately 0.017% (Feedly data), indicating a currently low but non-negligible probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Nessus plugin 305816 (Tenable).

1. Reconnaissance: Identify internet-facing or network-accessible Orthanc DICOM server instances (versions ≤ 1.12.10) using tools like Shodan, Censys, or direct network scanning for the default Orthanc HTTP port (8042) or DICOM port (4242).
2. Craft malicious DICOM file: Create a DICOM image file in which the dimension fields (rows/columns) are encoded using VR UL (4-byte unsigned long) with extremely large values (e.g., near 2^32), rather than the standard VR US (2-byte unsigned short).
3. Trigger integer overflow: The oversized dimension values cause an integer overflow during frame size calculation in the DICOM image decoder, resulting in allocation of a buffer far smaller than the actual pixel data to be written.
4. Submit crafted file: Upload the malicious DICOM file to the Orthanc server via its REST API (e.g., HTTP POST to /instances) or via the DICOM protocol. No authentication is required by default.
5. Achieve out-of-bounds write: During image decoding, the server writes pixel data beyond the allocated buffer boundary, corrupting adjacent heap memory. Depending on heap layout, this may crash the server (DoS), leak heap data, or enable arbitrary code execution (CERT/CC Advisory, Machine Spirits Advisory).

• Network: Unexpected or repeated HTTP POST requests to /instances or DICOM C-STORE operations from untrusted sources; large or malformed DICOM files submitted to the server from external IPs.
• Logs: Orthanc server logs showing crashes or unexpected process termination during image decoding; error messages referencing DICOM image decoder or frame size calculation failures.
• Process: Orthanc process terminating unexpectedly or restarting frequently; unusual child processes spawned by the Orthanc service account.
• File System: Presence of crafted DICOM files with anomalously large dimension metadata stored in the Orthanc data directory; core dump files generated by the Orthanc process.

Orthanc has released version 1.12.11 to address CVE-2026-5442 and all related vulnerabilities (CVE-2026-5437 through CVE-2026-5445); upgrading immediately is the primary recommended action (CERT/CC Advisory). As interim mitigations, administrators should restrict network access to Orthanc's HTTP (port 8042) and DICOM (port 4242) interfaces to trusted hosts and networks only, implement input validation or filtering for DICOM files at the network perimeter, and consider network segmentation to isolate DICOM servers from broader hospital or enterprise networks. Monitoring for anomalous DICOM processing activity and unexpected server crashes should also be implemented.

The vulnerability was discovered and responsibly disclosed by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG, who identified nine vulnerabilities in Orthanc and coordinated disclosure through CERT/CC (CERT/CC Advisory). Security news outlets including Security Online and News4Hackers covered the broader set of Orthanc vulnerabilities, highlighting the healthcare sector risk (Security Online). Rescana and BeyondMachines published risk summaries emphasizing the critical nature of the flaws for healthcare systems (Rescana). Red Hat also acknowledged the CVE in their security tracking (Red Hat).