CVE-2026-5445: 
NixOS vulnerability analysis and mitigation

CVE-2026-5445 is an out-of-bounds read vulnerability in the DecodeLookupTable function within DicomImageDecoder.cpp of the Orthanc DICOM Server. The flaw affects all Orthanc versions up to and including 1.12.10, and was publicly disclosed on April 9, 2026, following responsible disclosure to the vendor on March 12, 2026. It is one of nine vulnerabilities (CVE-2026-5437 through CVE-2026-5445) identified by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (CERT/CC Advisory, GitHub Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). The DecodeLookupTable function, which handles PALETTE COLOR DICOM image decoding, fails to validate pixel indices against the bounds of the lookup table before accessing memory. An attacker can craft a malicious DICOM image containing pixel indices larger than the declared palette size, causing the decoder to read beyond the allocated lookup table buffer and embed heap memory contents into the rendered output image. Exploitation requires no authentication, no user interaction, and is remotely triggerable over the network by uploading a crafted DICOM file to an exposed Orthanc endpoint. A dedicated advisory with technical details is available from the discovering researchers (CERT/CC Advisory, Machine Spirits Advisory).

Successful exploitation results in high confidentiality impact — heap memory contents, which may include allocator metadata, internal identifiers, adjacent DICOM content, or other sensitive in-memory data, are exposed through the rendered output image. Availability is also highly impacted, as the out-of-bounds read can contribute to process instability. In the broader context of the nine Orthanc vulnerabilities disclosed simultaneously, some related flaws (CVE-2026-5442, CVE-2026-5443) can lead to remote code execution, and malicious DICOM content may be stored and re-triggered during normal processing, increasing persistence and operational impact in healthcare environments (CERT/CC Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is remotely exploitable without authentication or user interaction, lowering the barrier for potential attackers. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation within the next 30 days. CVE-2026-5445 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugin 305811 is available for scanning (Tenable).

1. Reconnaissance: Identify internet-facing or network-accessible Orthanc DICOM Server instances running version 1.12.10 or earlier using tools like Shodan (searching for DICOM service banners or Orthanc web interfaces on ports 4242/8042).
2. Craft malicious DICOM file: Create a PALETTE COLOR DICOM image where pixel data contains indices that exceed the declared palette/lookup table size. This can be done using DICOM manipulation libraries (e.g., pydicom) by setting pixel values larger than the number of entries in the lookup table descriptor.
3. Upload crafted image: Submit the malicious DICOM file to the Orthanc server via the DICOM protocol (port 4242) using a DICOM C-STORE operation, or via the REST API (port 8042) using an HTTP POST to /instances.
4. Trigger decoding: Request the server to render or retrieve the uploaded image (e.g., via /instances/{id}/preview or /instances/{id}/frames/0/raw), causing DecodeLookupTable to process the crafted palette indices.
5. Extract heap data: Retrieve the rendered output image; out-of-bounds heap memory contents will be embedded in the image pixel data, which can then be analyzed for sensitive information such as memory addresses, internal identifiers, or adjacent DICOM content (CERT/CC Advisory, Machine Spirits Advisory).

• Network: Unexpected DICOM C-STORE connections (port 4242) from untrusted or external IP addresses; unusual HTTP POST requests to /instances on the Orthanc REST API (port 8042) from unknown sources; repeated image retrieval requests (e.g., /instances/{id}/preview) shortly after upload from the same source.
• File System: Presence of anomalous DICOM files in the Orthanc storage directory with PALETTE COLOR photometric interpretation and unusually small palette descriptor values relative to pixel data range.
• Logs: Orthanc access logs showing uploads of DICOM files with PhotometricInterpretation = PALETTE COLOR followed immediately by image rendering requests; any crash or error logs from DicomImageDecoder.cpp referencing DecodeLookupTable.
• Process: Orthanc process crashes or unexpected restarts following DICOM image upload and rendering operations (CERT/CC Advisory).

Orthanc has released version 1.12.11 to address CVE-2026-5445 and all eight related vulnerabilities; upgrading immediately is the primary recommended remediation (CERT/CC Advisory). As a configuration-based workaround, administrators should restrict access to DICOM upload endpoints (ports 4242 and 8042) to trusted networks and authenticated users only, using firewall rules or network segmentation. Additionally, monitoring for suspicious DICOM image submissions with unusual palette configurations and reviewing Orthanc deployment configurations to limit exposure of image processing functionality are recommended interim steps (GitHub Advisory).

The vulnerability was covered in several security news outlets highlighting the broader set of Orthanc DICOM Server flaws, with articles noting the healthcare sector impact and potential for RCE and data leaks (News4Hackers, CXO Digital Pulse). The Hacker News included the Orthanc vulnerabilities in its weekly security recap, reflecting broader community awareness (The Hacker News). Rescana published an analysis emphasizing the risk to healthcare systems from the full set of nine vulnerabilities (Rescana). Red Hat also tracked the CVE, indicating relevance to Linux-based deployments (Red Hat).