LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Nine CVEs in Orthanc, and the image decoder is the soft spot

MedDevice Cyber Staff · Apr 9 · 3 min read · Via CERT/CC

CERT/CC published VU#536588 on the Orthanc open-source DICOM server, every version up to and including 1.12.10, fixed in 1.12.11. Nine CVEs, CVE-2026-5437 through CVE-2026-5445. The dangerous cluster is in the DICOM image decoder: heap buffer overflows rated as high as 9.8, out-of-bounds reads, and memory exhaustion through decompression bombs and unbounded Content-Length. Impact runs from crash and memory leak to potential remote code execution.

Simon Weber and Volker Schoenefeld of Machine Spirits UG found them, the same researchers behind the OHIF work. A pattern is forming across the year: parsers that accept attacker-controlled medical file formats are where the CVEs are landing.

If you embed Orthanc, get to 1.12.11. If you wrote your own decoder, the lesson transfers. Fuzz the format parser, cap the allocations, and treat every incoming DICOM object as hostile until proven otherwise.

Remediation Desk

CERT/CC VU#536588 lists nine flaws in Orthanc through 1.12.10, including critical heap overflows in the image decoder and a decompression-bomb path to memory exhaustion. Update past 1.12.10, put the server behind authentication, and cap resource use so a single crafted file cannot exhaust memory.

Update past 1.12.10. Move to the fixed Orthanc release that closes the VU#536588 findings.
Authenticate and segment the server. Require authentication on the HTTP interface and keep the archive off any network segment that does not need it.
Bound decoder resources. Set memory and size limits on image decoding so a decompression bomb hits a limit instead of the whole host.
Harden the parser path. If you embed Orthanc or its decoder, fuzz the image path and run it with least privilege.

Sources

CERT/CC ↗

Questions & Answers

What was disclosed in the Orthanc DICOM server?

CERT/CC VU#536588 covers nine flaws in the Orthanc open-source DICOM server through version 1.12.10, including heap overflows in the image decoder rated up to critical.

Why does the image decoder matter so much?

The decoder parses files that arrive from other systems, so a malformed image can reach it without a login. That makes the decoder the part most likely to be hit first.

Who needs to act on this?

Anyone running Orthanc directly, and also teams who embed it inside a commercial product. Update to a release past 1.12.10 and check whether your vendor bundles Orthanc under the hood.

← Back to Vulnerabilities