CVE-2026-5441

HIGH

7.1

Description

An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output.

CVE Details

CVSS v3.1 Score7.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published4/9/2026

Last Modified4/14/2026

Sourcenvd

Honeypot Sightings0

Affected Products

orthanc-server:orthanc

Weaknesses (CWE)

CWE-125

References

https://kb.cert.org/vuls/id/536588(cret@cert.org)

https://www.machinespirits.de/(cret@cert.org)

https://www.orthanc-server.com/(cret@cert.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.