The Orthanc DICOM Server contains a heap buffer overflow vulnerability (CVE-2026-5442) due to improper handling of dimension fields in DICOM images. The decoder expects dimensions encoded as VR Unsigned Short but instead processes VR Unsigned Long, enabling extremely large dimension values. This causes an integer overflow during the calculation of frame size, resulting in out-of-bounds memory access during image decoding. This vulnerability can lead to memory corruption with potential for arbitrary code execution or denial of service. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official fix or patch is currently documented, and no known exploits have been reported.

Successful exploitation of this vulnerability can cause heap buffer overflow leading to out-of-bounds memory access. This may allow an attacker to execute arbitrary code, crash the server, or cause denial of service. The critical CVSS score of 9.8 indicates a severe impact on confidentiality, integrity, and availability of the affected system. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is available, restrict exposure of the Orthanc DICOM Server to untrusted networks and validate or sanitize DICOM images before processing to mitigate risk.