CVE-2026-5445: Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)
An out-of-bounds read vulnerability exists in the DecodeLookupTable function within DicomImageDecoder.cpp. The lookup-table decoding logic used for PALETTE COLOR images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5445?
CVE-2026-5445 has a severity rating of critical with a CVSS score of 9.1.
How do I fix CVE-2026-5445?
To fix CVE-2026-5445, update the Orthanc server to the latest version where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-5445?
CVE-2026-5445 is an out-of-bounds read vulnerability affecting the `DecodeLookupTable` function.
What is the impact of exploiting CVE-2026-5445?
Exploiting CVE-2026-5445 can allow an attacker to read unauthorized memory areas, potentially leading to data leakage.
Which software is affected by CVE-2026-5445?
CVE-2026-5445 affects the Orthanc server and its handling of DICOM images.