CVE-2026-87020

High8.1Published on September 11, 2026

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

CVSS score8.1 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness type (CWE)CWE-190

Vulnerabilities

Orthanc DICOM Server Flaw Allows Authenticated Attackers to Corrupt Heap Memory

CVE-2026-87020 lets authenticated attackers crash Orthanc DICOM Server <1.13.0 via malicious PNG causing heap overflow. Learn impact and fixes.

Sep 13, 202619:445 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Orthanc DICOM Server Flaw Allows Authenticated Attackers to Corrupt Heap Memory