CVE-2026-5443: 
NixOS vulnerability analysis and mitigation

CVE-2026-5443 is a heap buffer overflow vulnerability in the Orthanc DICOM Server affecting the decoding of PALETTE COLOR DICOM images. The flaw arises from 32-bit integer overflow during pixel length validation (width × height multiplication), causing the validation check to incorrectly succeed and allowing the decoder to read and write beyond allocated memory buffers. It affects Orthanc versions 0 through 1.12.10 (all versions prior to 1.12.11) and was publicly disclosed on April 9, 2026, by CERT/CC following responsible disclosure by researchers at Machine Spirits UG. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (CERT/CC Advisory, GitHub Advisory).

The root cause is an integer overflow (CWE-787: Out-of-bounds Write) in the DICOM image decoder's DicomImageDecoder.cpp, specifically in the code path that handles PALETTE COLOR photometric interpretation. When computing the expected pixel buffer size, the decoder multiplies image width and height using 32-bit arithmetic; if the product exceeds 2^32, the result wraps around to a small value, causing the bounds check to pass even though the actual pixel data is far larger than the allocated buffer. This allows an attacker to supply a crafted DICOM file with specially chosen width and height values that trigger the overflow, leading to out-of-bounds reads and writes during image decoding. The attack is network-accessible, requires no authentication or user interaction, and can be triggered by uploading or causing the server to process a malicious DICOM file. A dedicated technical advisory for this specific issue is available from the discovering researchers (CERT/CC Advisory, Machine Spirits Advisory).

Successful exploitation can result in heap memory corruption, enabling information disclosure through out-of-bounds reads (exposing heap-resident data such as allocator metadata, internal identifiers, and adjacent DICOM content in rendered image output), denial of service via process crash, and potentially remote code execution through controlled out-of-bounds writes to critical memory regions. Because Orthanc is widely deployed in healthcare environments to store and process medical imaging data, exploitation could compromise the confidentiality of sensitive patient data, the integrity of medical records, and the availability of critical diagnostic infrastructure. Additionally, malicious DICOM content may be stored and re-triggered during normal processing, increasing the persistence and operational impact of exploitation (CERT/CC Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a low near-term probability of exploitation. However, the zero-authentication network attack vector and critical CVSS score make it a high-priority patching target, particularly for internet-exposed Orthanc deployments in healthcare settings (CERT/CC Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Orthanc DICOM Server instances running versions 1.12.10 or earlier using tools like Shodan (searching for Orthanc's default HTTP port 8042) or by scanning for DICOM port 4242.
2. Craft malicious DICOM file: Create a DICOM file with Photometric Interpretation set to PALETTE COLOR and width/height values specifically chosen so that their 32-bit product overflows (e.g., values near 2^16 such as 65537 × 65537), causing the pixel buffer size calculation to wrap to a small value.
3. Upload or transmit the file: Send the crafted DICOM file to the Orthanc server via the REST API (e.g., HTTP POST to /instances) or via the DICOM network protocol (C-STORE). No authentication is required if the server is configured with default open access.
4. Trigger decoding: The server automatically decodes the uploaded DICOM image. The overflowed size check passes, and the decoder reads/writes pixel data beyond the allocated heap buffer.
5. Achieve objective: Depending on heap layout and exploitation technique, the attacker may cause a server crash (DoS), leak heap memory contents through rendered image output, or achieve remote code execution by overwriting critical heap structures (CERT/CC Advisory, Machine Spirits Advisory).

• Network: Unexpected HTTP POST requests to /instances or DICOM C-STORE transmissions containing DICOM files with PALETTE COLOR photometric interpretation and unusually large or near-maximum width/height values (e.g., values near 65535–65537); anomalous outbound connections from the Orthanc server process following image upload.
• File System: Presence of crafted DICOM files with PALETTE COLOR photometric interpretation and extreme dimension values in the Orthanc storage directory; unexpected core dump files or crash reports from the Orthanc process.
• Logs: Orthanc server logs showing crashes or unhandled exceptions during image decoding of PALETTE COLOR images; repeated failed or unusual image upload attempts from a single source IP; error messages referencing DicomImageDecoder or palette color decoding in Orthanc application logs.
• Process: Orthanc process terminating unexpectedly or restarting; unusual child processes spawned by the Orthanc service account following DICOM file processing (CERT/CC Advisory).

Orthanc has released version 1.12.11 to address CVE-2026-5443 and all related vulnerabilities (CVE-2026-5437 through CVE-2026-5445); upgrading to 1.12.11 or later is the primary recommended remediation (CERT/CC Advisory). As interim mitigations, administrators should restrict DICOM image upload and processing to trusted sources only, implement network segmentation to limit exposure of DICOM processing services (ports 8042 and 4242), and consider disabling PALETTE COLOR DICOM image processing if not operationally required. Monitoring for DICOM files with unusual width and height parameters can help detect exploitation attempts prior to patching (Feedly).

The vulnerability was discovered and responsibly disclosed by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG, who identified nine distinct vulnerabilities in Orthanc 1.12.10 and earlier (CERT/CC Advisory). Security news outlets including Security Online and News4Hackers covered the broader set of Orthanc vulnerabilities, highlighting the risk to healthcare systems from crashes and potential remote code execution (Security Online). Rescana and BeyondMachines published analysis emphasizing the critical nature of the flaws for healthcare infrastructure (Rescana). Red Hat also acknowledged the CVE in their security tracking (Red Hat).