CISA 2026-09-10

Orthanc DICOM Server

CVE-2026-87020

Machine-generated analysis · WAYSCloud LLM

Orthanc DICOM Server versions prior to 1.13.0 can be crashed via a crafted PNG or JPEG image.

Context

The advisory concerns Orthanc DICOM Server. It states that an authenticated remote attacker can trigger an integer overflow when Orthanc decodes a malicious PNG or JPEG, resulting in a heap out-of-bounds write, process crash, and denial-of-service. The vulnerability is identified as CVE-2026-87020 and affects all versions earlier than 1.13.0. Orthanc recommends updating to version 1.13.0 to remediate the issue.

Operator considerations

Check: Verify the installed Orthanc DICOM Server version is earlier than 1.13.0.
Patch: Apply the update to Orthanc DICOM Server version 1.13.0 or later.
Isolate: Restrict network access to Orthanc instances to trusted hosts only.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an authenticated remote attacker to write past the end of a heap allocation when Orthanc decodes an attacker-supplied PNG or JPEG image, resulting in a crash of the Orthanc process and a denial-of-service condition.

The following versions of Orthanc DICOM Server are affected:

Orthanc DICOM Server

Read the full advisory on CISA →