Orthanc DICOM Server
CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.
CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.
- CVE-2026-87020 affects Orthanc DICOM Server <1.13.0 with CVSS 3.1 score 8.1.
- Authenticated remote attackers can crash the process via crafted PNG or JPEG images.
- Healthcare and Public Health is the affected critical infrastructure sector; deployment is worldwide.
- CISA recommends minimizing network exposure and updating beyond version 1.13.0.
- CVEs
- CVE-2026-87020
- Products
- Orthanc DICOM Server
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87020 | Heap Out-of-Bounds Write in Orthanc DICOM Server PNG Decoding | 7.2 | — |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an authenticated remote attacker to write past the end of a heap allocation when Orthanc decodes an attacker-supplied PNG or JPEG image, resulting in a crash of the Orthanc process and a denial-of-service condition. The following versions of Orthanc DICOM Server are affected: Orthanc DICOM Server <1. 13.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.