The Orthanc DICOM Server contains a vulnerability in the DecodePsmctRle1 function within DicomImageDecoder.cpp. Specifically, the PMSCT_RLE1 decompression routine does not properly validate escape markers placed near the end of the compressed data stream. This improper validation allows an attacker to craft a sequence that causes an out-of-bounds read beyond the allocated memory buffer, resulting in leakage of heap memory data into the output image. The vulnerability is tracked as CVE-2026-5441 and is classified under CWE-125 (Out-of-bounds Read). The CVSS 3.1 base score is 7.1, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation of this vulnerability can lead to leakage of sensitive heap memory data through the rendered image output, potentially exposing confidential information. The vulnerability also impacts availability due to the out-of-bounds read causing potential application crashes or denial of service. There is no indication of integrity compromise. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is released, avoid processing untrusted or malformed Philips Compression format data with the affected Orthanc DICOM Server versions. Monitor the vendor advisory for updates on patches or mitigations.