Skip to content
OpenAdvisories
High · 7.5 CVE-2026-5437 EUVD-2026-20913GHSA-gqwr-8hwp-hh46

Out-of-Bounds Read in DicomStreamReader

Published Apr 9, 2026 · Updated Apr 14, 2026 · Assigned by certcc

Description

An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing. When processing malformed metadata structures, the parser may read beyond the bounds of the allocated metadata buffer. Although this issue does not typically crash the server or expose data directly to the attacker, it reflects insufficient input validation in the parsing logic.

Affected products

VendorProductAffectedFixed
Orthanc DICOM Server ≤ 1.12.10 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 orthanc 1.12.10+dfsg-4 —
Debian 13 orthanc No fix yet —
Debian 12 orthanc No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 orthanc No fix yet —
Ubuntu 26.04 LTS orthanc No fix yet —
Ubuntu 25.10 orthanc No fix yet —
Ubuntu 24.04 LTS orthanc No fix yet —
Ubuntu 22.04 LTS orthanc No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS orthanc No fix yet —
Ubuntu 18.04 LTS orthanc No fix yet —
Ubuntu 16.04 LTS orthanc No fix yet —

References