Heap Overflow in Orthanc DICOM Server (CVE‑2026‑87020) Enables Remote Denial‑of‑Service
What It Is – Orthanc DICOM Server < 1.13.0 contains an integer‑overflow bug in its PNG/JPEG image decoder. An authenticated attacker can craft a malicious image that writes past the end of a heap allocation, crashing the service.
Exploitability – The vulnerability is publicly disclosed (CVE‑2026‑87020) with a CVSS 3.1 base score of 8.1 (High). No public exploit code is known, but the attack requires only network access and valid credentials.
Affected Products – Orthanc DICOM Server versions prior to 1.13.0 (vendor: Orthanc, Belgium).
Why It Matters for Trust & Control Assurance
- Patch Management & Evidence – Demonstrating timely remediation of high‑severity flaws is a core control objective; continuous monitoring of patch status provides audit‑ready evidence.
- Availability Controls – A DoS condition on a medical imaging server can interrupt patient care workflows; controls around system resilience and incident logging must be verifiable.
- Supply‑Chain Assurance – Orthanc is widely deployed in healthcare; third‑party risk programs need to capture vulnerability exposure and remediation proof for downstream auditors.
Recommended Actions
- Upgrade all Orthanc instances to version 1.13.0 or later.
- Verify the patch by scanning for the CVE identifier and confirming the version number.
- Enable process‑level monitoring (e.g., crash‑dump collection, health‑check alerts) to detect any attempted exploitation.
- Document the remediation in your vulnerability‑management system to provide defensible evidence for audits.
Source: CISA Advisory – ICSMA‑26‑253‑02