CVE-2026-5445 Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)
Attackers can craft DICOM images to trigger an out-of-bounds read, exposing heap memory contents in the decoded output.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5445?
CVE-2026-5445 is a critical vulnerability in Orthanc DICOM Server, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image.
Weakness: CWE-125
Which versions are affected by CVE-2026-5445?
It affects 1 product.
Products include Orthanc-Server Orthanc.
How do I fix CVE-2026-5445?
Apply the vendor's patch.
Is CVE-2026-5445 being exploited?
There is no known exploitation of CVE-2026-5445 in the wild and no public exploit code.
Other vulnerabilities in Orthanc DICOM Server
- CVE-2026-5442 Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions
- CVE-2026-5443 Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)
- CVE-2025-0896 Orthanc Server Missing Authentication for Critical Function
- CVE-2023-33466 Path traversal in n/a
- CVE-2026-5437 Out-of-Bounds Read in DicomStreamReader
Sources
Also known as DEBIAN-CVE-2026-5445, GHSA-g69c-6pfv-54p9, UBUNTU-CVE-2026-5445.