CVE-2026-5439: Memory Exhaustion via Forged ZIP Metadata
A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and trusts metadata fields describing the uncompressed size of archived files. An attacker can craft a small ZIP archive containing a forged size value, causing the server to allocate extremely large buffers during extraction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5439?
The severity of CVE-2026-5439 is rated high with a CVSS score of 7.5.
How do I fix CVE-2026-5439?
To fix CVE-2026-5439, update Orthanc to the latest version that addresses this vulnerability.
What impact does CVE-2026-5439 have on systems?
CVE-2026-5439 can lead to memory exhaustion, potentially causing the affected system to crash.
Which software is affected by CVE-2026-5439?
CVE-2026-5439 affects Orthanc and Orthanc-server installations.
How can an attacker exploit CVE-2026-5439?
An attacker can exploit CVE-2026-5439 by uploading a crafted ZIP archive with forged size values to vulnerable endpoints.