VDB
CVE-2026-5442
CVE-2026-5442
PUBLISHED
A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimension fields are encoded using Value Representation (VR) Unsigned Long (UL), instead of the expected VR Unsigned Short (US), which allows extremely large dimensions to be processed. This causes an integer overflow during frame size calculation and results in out-of-bounds memory access during image decoding.
EPSS 0.07% · 21.1th percentile
Risk Scores
EPSS Score
0.07%
21.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Orthanc | DICOM Server | 0 |
Timeline
- Apr 9, 2026 CVE Published
- Apr 9, 2026 PoC Published
- Apr 9, 2026 Security Advisory
- Apr 10, 2026 EPSS Score
- Apr 14, 2026 CVE Updated
- Apr 15, 2026 Security Advisory
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score