Description
A security flaw has been discovered in Orthanc DICOM Server up to 1.12.11. This issue affects the function DcmItem::read of the file OrthancFramework/Sources/DicomParsing/FromDcmtkBridge.cpp of the component DCMTK Parser. Performing a manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named bae99026ca97. To fix this issue, it is recommended to deploy a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Orthanc | DICOM Server | 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 1.12.5, 1.12.6, 1.12.7, 1.12.8, 1.12.9, 1.12.10, 1.12.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | orthanc | 1.13.0+dfsg-1 | — |
| Debian 13 | orthanc | No fix yet | — |
| Debian 12 | orthanc | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | orthanc | No fix yet | — |
| Ubuntu 26.04 LTS | orthanc | No fix yet | — |
| Ubuntu 25.10 | orthanc | No fix yet | — |
| Ubuntu 24.04 LTS | orthanc | No fix yet | — |
| Ubuntu 22.04 LTS | orthanc | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | orthanc | No fix yet | — |
| Ubuntu 18.04 LTS | orthanc | No fix yet | — |
| Ubuntu 16.04 LTS | orthanc | No fix yet | — |
References
- VDB-367636 | Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-based overflow vdb-entry technical-description
- VDB-367636 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-10528 | CVE Analysis and Report third-party-advisory
- Submit #820766 | orthanc orthanc core ≤ 1.12.11 Denial of Service third-party-advisory
- https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=258 issue-tracking
- https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=258#c4 issue-tracking
- https://orthanc.uclouvain.be/bugs/attachment.cgi?id=150 exploit
- https://orthanc.uclouvain.be/hg/orthanc/rev/bae99026ca97 patch