Orthanc DICOM Server Patches Integer Overflow That Corrupts Heap Memory

MedDevice Cyber Staff · 6 days ago · 2 min read · Via CISA ICSMA-26-253-02

CISA published ICSMA-26-253-02 on September 10, the same day as the Mirth Connect advisory, this time for the open source Orthanc DICOM server. CVE-2026-87020 scores 8.1 on CVSS v3.1 and 7.2 on CVSS v4.0, and it hits every deployment running a version older than 1.13.0.

The bug is an integer overflow in the pitch and buffer size computation Orthanc runs when it decodes an image, tracked as CWE-190. Feed the server a malformed PNG or JPEG and the miscalculated buffer size drives a heap out of bounds write. CISA credits the finding to Andrej Tomci. Exploitation requires an authenticated attacker, but Orthanc is frequently exposed with weak or default authentication across research and small clinical deployments, which narrows that requirement considerably in practice.

Orthanc sits underneath a large share of the open source medical imaging stack: PACS installations, DICOM routing, and research pipelines all lean on it to store and serve studies. A crash there does not stay contained to one viewer; it disables whatever imaging workflow depends on the server, and CISA's advisory flags worldwide healthcare and public health deployment.

The fix is version 1.13.0, posted to the project's own download page rather than a commercial portal, typical for Orthanc's open source distribution model. Anyone running an older build should treat this the same way as the GDCM and OHIF findings CISA rolled up earlier this year: the open source DICOM stack keeps surfacing memory safety bugs because so much of medical imaging software still parses untrusted files in C and C++.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Orthanc DICOM Server to version 1.13.0, posted on the project's own download page, to fix CVE-2026-87020. Until the update runs, treat any Orthanc instance that accepts image uploads from outside a trusted network as exposed, since exploitation only needs an authenticated session and Orthanc is commonly run with weak or default credentials. Restrict who can push studies to the server while the patch rolls out.

Update to Orthanc 1.13.0. Download the fixed build from the project's own download page; it resolves CVE-2026-87020.
Require real authentication on every Orthanc instance. Disable default or blank credentials before the server is reachable from any shared network.
Limit who can upload studies. Restrict DICOM store and upload access to known modalities and systems while the update rolls out.
Validate image dimensions before decode. Where custom integrations sit in front of Orthanc, reject PNG or JPEG files with implausible pitch or buffer parameters before they reach the decoder.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

parse_image

Contributing

sys_ots_software net_remote_access app_user_accounts use_hospital_net net_wired app_database data_phi

EMB3D

PID-3122

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-87020 in Orthanc DICOM Server?

CVE-2026-87020 is an integer overflow in Orthanc DICOM Server's pitch and buffer size computation, CVSS 8.1, that causes a heap out of bounds write when the server decodes a malicious PNG or JPEG image. It affects all versions before 1.13.0.

Is there a patch for CVE-2026-87020 in Orthanc?

Yes. Orthanc fixed CVE-2026-87020 in version 1.13.0, available from the project's download page. CISA advisory ICSMA-26-253-02 covers the flaw, published September 10, 2026.

Who found the Orthanc DICOM Server integer overflow vulnerability?

Researcher Andrej Tomci reported CVE-2026-87020 to CISA, which published the finding as ICSMA-26-253-02 on September 10, 2026.

← Back to Vulnerabilities