CVE-2026-5439

{
  "id": "CVE-2026-5439",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T15:16:15.443",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and trusts metadata fields describing the uncompressed size of archived files. An attacker can craft a small ZIP archive containing a forged size value, causing the server to allocate extremely large buffers during extraction."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de agotamiento de memoria existe en el procesamiento de archivos ZIP. Orthanc extrae automáticamente los archivos ZIP subidos a ciertos puntos finales y confía en los campos de metadatos que describen el tamaño sin comprimir de los archivos archivados. Un atacante puede crear un pequeño archivo ZIP que contenga un valor de tamaño falsificado, lo que provoca que el servidor asigne búferes extremadamente grandes durante la extracción."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Orthanc",
          "product": "DICOM Server",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.12.10",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T15:15:14.226462Z",
          "id": "CVE-2026-5439",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.12.11",
              "matchCriteriaId": "A259075D-8B77-4B04-BC42-3E5ABE9DFE1F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://kb.cert.org/vuls/id/536588",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://www.machinespirits.de/",
      "source": "[email protected]",
      "tags": [
        "Not Applicable"
      ]
    },
    {
      "url": "https://www.orthanc-server.com/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}