CVE-2026-5445

{
  "id": "CVE-2026-5445",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T15:16:16.863",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de lectura fuera de límites en la función ’DecodeLookupTable’ dentro de ’DicomImageDecoder.cpp’. La lógica de decodificación de tabla de búsqueda utilizada para imágenes ’PALETTE COLOR’ no valida los índices de píxeles contra el tamaño de la tabla de búsqueda. Imágenes manipuladas que contienen índices mayores que el tamaño de la paleta hacen que el decodificador lea más allá de la memoria asignada para la tabla de búsqueda y exponga el contenido del heap en la imagen de salida."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Orthanc",
          "product": "DICOM Server",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.12.10",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T15:08:58.289132Z",
          "id": "CVE-2026-5445",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.12.11",
              "matchCriteriaId": "A259075D-8B77-4B04-BC42-3E5ABE9DFE1F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://kb.cert.org/vuls/id/536588",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://www.machinespirits.de/",
      "source": "[email protected]",
      "tags": [
        "Not Applicable"
      ]
    },
    {
      "url": "https://www.orthanc-server.com/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}