This vulnerability (CVE-2026-5439) affects Orthanc DICOM Server's handling of ZIP archives. The server trusts metadata fields indicating the uncompressed size of files within uploaded ZIP archives. An attacker can exploit this by submitting a ZIP archive with a forged uncompressed size value, causing the server to allocate very large buffers during extraction. This results in memory exhaustion, potentially causing denial of service. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service).

Successful exploitation leads to memory exhaustion on the Orthanc DICOM Server, causing denial of service conditions. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until a fix is available, consider restricting or validating ZIP archive uploads to prevent processing of maliciously crafted archives. Avoid trusting unverified metadata fields in uploaded archives where possible.