CVE-2026-5444: 
NixOS vulnerability analysis and mitigation

CVE-2026-5444 is a heap buffer overflow vulnerability in the PAM (Portable Arbitrary Map) image parsing logic of Orthanc DICOM Server. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic, allowing specially chosen values to cause an integer overflow during buffer size calculation. This results in the allocation of an undersized buffer followed by a much larger write operation during pixel processing. All Orthanc versions prior to 1.12.11 are affected. It was publicly disclosed on April 9, 2026, with a CVSS v3.1 base score of 7.1 (High) (CERT/CC, GitHub Advisory).

The root cause is an integer overflow (CWE-787: Out-of-bounds Write) in the PAM image parsing code, where 32-bit unsigned arithmetic is used to multiply image width and height dimensions without overflow checks. When an attacker supplies specially crafted dimension values in a PAM image embedded within a DICOM file, the multiplication wraps around, producing a small calculated buffer size. The server then allocates this undersized heap buffer but subsequently writes a much larger amount of pixel data into it, resulting in a heap buffer overflow. Exploitation requires local access and user interaction — specifically, a user or automated process must open or process the malicious DICOM file. The vulnerability was discovered and disclosed by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG, with a dedicated advisory published at https://www.machinespirits.de/advisory/b7ced5/ (CERT/CC).

Successful exploitation can lead to heap memory corruption, which may result in process crashes (denial of service), potential arbitrary code execution, or memory disclosure depending on heap layout at the time of exploitation. In healthcare environments where Orthanc is used to store and process medical imaging data, a crash or compromise of the DICOM server could disrupt clinical workflows and patient data availability. Additionally, because malicious DICOM content can be stored and later re-triggered during normal processing, the impact may persist beyond the initial attack (CERT/CC, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.019% (3rd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction (a user or process must open the crafted DICOM file), which limits the attack surface compared to fully remote, unauthenticated vulnerabilities.

1. Craft malicious DICOM file: Create a DICOM file containing an embedded PAM image with specially chosen width and height dimension values that, when multiplied as 32-bit unsigned integers, overflow to produce a small value (e.g., values near 2^16 such that width × height × bytes_per_pixel wraps around).
2. Embed PAM image: Structure the PAM image header within the DICOM file so that the declared dimensions trigger the integer overflow in Orthanc's PAM parsing logic during buffer size calculation.
3. Deliver the file: Upload the crafted DICOM file to an Orthanc instance via its REST API upload endpoint (e.g., POST /instances) or through any other supported ingestion mechanism (DICOM C-STORE, file system import).
4. Trigger processing: Cause Orthanc to process the image — this may happen automatically upon upload or when a user or automated system requests image rendering/decoding.
5. Achieve heap overflow: Orthanc allocates a small heap buffer based on the overflowed size calculation, then writes a much larger amount of pixel data into it, corrupting adjacent heap memory and potentially enabling denial of service or code execution (CERT/CC).

• Logs: Orthanc server logs showing unexpected crashes or segmentation faults during DICOM file processing or image decoding; error messages referencing PAM image parsing failures.
• Process: Orthanc process terminating unexpectedly (core dumps on Linux, crash reports on Windows) after ingesting a DICOM file; unusual child processes spawned by the Orthanc service.
• File System: Presence of unexpected or malformed DICOM files in the Orthanc storage directory with embedded PAM images containing anomalous dimension values; core dump files in the Orthanc working directory.
• Network: Repeated upload attempts of the same or similar DICOM files to the Orthanc REST API (POST /instances) from an unexpected source IP, particularly if followed by server restarts (CERT/CC).

Orthanc has released version 1.12.11 to address CVE-2026-5444 and all related vulnerabilities in the batch (CVE-2026-5437 through CVE-2026-5445). Users are strongly advised to upgrade to Orthanc 1.12.11 or later as soon as possible. As interim mitigations, administrators should restrict access to Orthanc's upload and image processing endpoints to trusted users and networks only, and consider implementing input validation or file filtering to block processing of untrusted DICOM files containing PAM images (CERT/CC, GitHub Advisory).

The vulnerability was part of a batch of nine vulnerabilities disclosed by Machine Spirits UG researchers Dr. Simon Weber and Volker Schönefeld, coordinated through CERT/CC. Security news outlets including News4Hackers and Rescana covered the broader Orthanc vulnerability disclosure, highlighting the risk to healthcare systems from potential crashes and remote code execution. Red Hat also tracked the CVE, reflecting concern about downstream impact on Linux distributions shipping Orthanc (CERT/CC, Red Hat).