Orthanc DICOM Server 1.13.0 Closes Integer Overflow Vulnerability
Authentication is required, limiting the blast radius, but a crash during routine image decoding still disrupts radiology workflows.
TL;DR
CISA published an advisory for CVE-2026-87020, an integer overflow in Orthanc DICOM Server versions below 1.13.0 that lets authenticated attackers trigger a denial-of-service condition through malformed PNG or JPEG image files. Healthcare facilities and imaging centers running Orthanc worldwide are affected; the vendor recommends updating to version 1.13.0. The authentication requirement limits the blast radius. This isn't remotely exploitable without credentials, but a crash during routine image decoding can still interrupt radiology workflows. This marks Orthanc's third CISA advisory since 2024.
The vulnerability sits in Orthanc's image decoding pipeline, specifically in the pitch and buffer-size computation that precedes a heap allocation. When the server processes an attacker-supplied PNG or JPEG, the integer overflow produces a heap out-of-bounds write that crashes the Orthanc process. CISA scores it CVSS v3.1 8.1 (HIGH), with no confidentiality impact but high integrity and availability damage: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The CVSS v4.0 score lands at 7.2, reflecting a similar profile.
The authentication requirement changes the exposure calculus. An attacker needs valid credentials to reach the vulnerable code path. This isn't a remote unauthenticated smash-and-grab. But for Orthanc instances where remote access is enabled without authentication, a configuration CISA flagged in a 2025 advisory, the practical exposure widens considerably. CISA reports no known public exploitation of this CVE.
The fix is updating to Orthanc 1.13.0. Standard ICS advisory mitigations apply: minimize network exposure, isolate medical device networks behind firewalls, and use VPNs for remote access. The operational wrinkle for healthcare IT teams is that imaging centers running Orthanc in live diagnostic workflows may need to schedule the update around patient care windows rather than pushing it immediately. It's a patch-and-move-on item for most teams, but the scheduling friction is real when the server is decoding studies mid-shift.
Published ·Deep Fathom