CVE-2026-5437 PUBLISHED

Out-of-Bounds Read in DicomStreamReader

Assigner: certcc
Reserved: 02.04.2026 Published: 09.04.2026 Updated: 09.04.2026

An out-of-bounds read vulnerability exists in DicomStreamReader during DICOM meta-header parsing. When processing malformed metadata structures, the parser may read beyond the bounds of the allocated metadata buffer. Although this issue does not typically crash the server or expose data directly to the attacker, it reflects insufficient input validation in the parsing logic.

Product Status

Vendor Orthanc
Product DICOM Server
Versions
  • affected from 0 to 1.12.10 (incl.)

References

Problem Types

  • CWE-125 Out-of-bounds Read