Orthanc DICOM Server Flaw Allows Authenticated Attackers to Corrupt Heap Memory

A high-severity vulnerability in Orthanc DICOM Server can let a remote, authenticated attacker trigger a heap out-of-bounds write by submitting a malicious image. The resulting memory corruption can crash the server process and interrupt access to services that support medical-imaging workflows.

CISA disclosed the issue in an ICS Medical Advisory published on September 10, 2026. The vulnerability, tracked as CVE-2026-87020, affects Orthanc DICOM Server versions earlier than 1.13.0.

There were no reports of public exploitation specifically targeting the flaw when CISA published its advisory. No associated threat actor, campaign, victim organization, or indicators of compromise have been identified.

Versions Before Orthanc 1.13.0 Are Affected

CVE-2026-87020 applies to Orthanc DICOM Server releases below version 1.13.0. The affected product is deployed worldwide in the Healthcare and Public Health sector, making availability a significant operational concern even when confidentiality is not directly affected.

Organizations should inventory their Orthanc installations and identify every instance running a release earlier than 1.13.0. This review should include systems reachable only through internal networks or remote-access infrastructure, not merely public-facing deployments.

The published version boundary indicates that moving to version 1.13.0 or later removes the server from the known-affected range. Administrators should follow Orthanc’s release and validation procedures rather than treating the update as a routine, context-free package replacement.

That validation matters in clinical environments. Changes affecting DICOM ingestion, processing, storage, or integration may need to be tested against connected systems before production deployment.

Integer Overflow Leads to an Undersized Heap Buffer

The underlying weakness is an integer overflow or wraparound, categorized as CWE-190. It occurs while Orthanc calculates an image’s pitch and the memory buffer required during decoding.

An attack follows this sequence:

1. An authenticated attacker sends an image whose dimensions or related properties influence the decoder’s arithmetic.
2. Orthanc calculates the image pitch and required buffer size.
3. The calculation overflows, producing an incorrect size or bounds value.
4. The application allocates insufficient heap memory or relies on invalid bounds.
5. Decoding writes beyond the allocated buffer.

The confirmed technical descriptions specifically identify attacker-controlled PNG files. CISA’s summary also mentions PNG or JPEG input, but the detailed CISA entry and the NVD description both name PNG decoding. Consequently, PNG is the clearly corroborated attack format; JPEG appears only in CISA’s broader summary.

A heap out-of-bounds write is a memory-safety failure, not merely malformed input being rejected. Data is written outside the region reserved for the image, potentially corrupting adjacent heap contents and destabilizing the Orthanc process.

The documented outcome is a crash and denial of service. Although the scoring assigns high integrity impact, the available information does not establish remote code execution, and administrators should not assume that such an outcome has been demonstrated. Likewise, no confidentiality impact is assigned.

Exploitation Requires a Valid Authenticated Session

The vulnerability is reachable over a network, requires low attack complexity, and does not depend on user interaction. However, an attacker must have low-level privileges on the Orthanc service.

This authentication requirement narrows the attack surface but does not make the issue harmless. Stolen credentials, compromised service accounts, over-permissive integrations, or another foothold inside a healthcare network could provide the access needed to submit the malicious image.

The CVSS 3.1 base score is 8.1, rated High, with the vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA also supplies a CVSS 4.0 score of 7.2, also High:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Both assessments describe a network-accessible attack requiring low privileges, low complexity, and no action from another user. The security impact remains within the vulnerable system’s authority. Confidentiality is scored as unaffected, while integrity and availability are rated High.

The practical risk is concentrated around service disruption and memory corruption. If the Orthanc process terminates while supporting operational imaging workflows, users may lose access until the service is restarted and the malicious input is removed or isolated.

No Public Exploitation or KEV Deadline Has Been Reported

Andrej Tomci reported CVE-2026-87020 to CISA. At the time the advisory was published, the agency said it had received no reports of known public exploitation specifically targeting the vulnerability.

No evidence currently connects the flaw to ransomware activity or a broader intrusion campaign. There are also no published indicators that defenders can use to identify a known exploit payload, infrastructure cluster, or attacker tool.

The available information does not establish that CVE-2026-87020 has been added to CISA’s Known Exploited Vulnerabilities catalog. No KEV remediation deadline has been provided. Organizations should therefore distinguish the flaw from vulnerabilities with confirmed exploitation, while still treating its network reachability and high availability impact seriously.

Absence from the supplied KEV information is not evidence that exploitation is impossible. It means there is no stated KEV status or mandatory federal deadline associated with this disclosure.

Upgrade, Reduce Exposure, and Watch Image-Processing Failures

The primary remediation is to upgrade every Orthanc DICOM Server instance running a version below 1.13.0. Administrators should first map dependencies and test the selected release against their clinical and technical requirements.

Exposure reduction provides an additional control. Orthanc servers and associated medical-device networks should remain off the public internet wherever possible. Firewalls should restrict access to required systems and users, while segmentation should separate healthcare or control-system environments from ordinary business networks.

Where remote connectivity is necessary, organizations should use secured remote-access channels such as VPNs. The VPN software must be kept current, but administrators should also evaluate the endpoints connecting through it. A protected tunnel does not compensate for a compromised remote workstation or stolen Orthanc credentials.

Defenders can take several immediate steps:

• Locate Orthanc DICOM Server installations and record their exact versions.
• Prioritize upgrades for every release earlier than 1.13.0.
• Review which accounts and integrations can upload or submit images.
• Restrict network paths to the server to explicitly authorized sources.
• Search logs for unexpected authenticated image submissions and repeated decoder failures.
• Investigate unexplained Orthanc crashes, restarts, or resource interruptions.
• Preserve suspicious PNG files for controlled analysis rather than reopening them through production services.
• Apply internal incident-response procedures if suspicious activity is found.

No vulnerability-specific indicators of compromise are available. Monitoring must therefore focus on behavior: unusual image ingestion, authentication anomalies, decoder errors, and process crashes occurring close together.

Organizations should perform an impact and risk assessment before changing network controls or production software. Defense-in-depth is particularly relevant where immediate upgrades are constrained by compatibility testing or clinical availability requirements, but segmentation and monitoring should not become substitutes for moving beyond the affected version range.