CVE-2026-5443 is a heap buffer overflow vulnerability in the Orthanc DICOM Server caused by integer overflow during pixel length validation in PALETTE COLOR image decoding. The vulnerability occurs because width and height are multiplied using 32-bit integers, which can overflow and bypass buffer size checks. This results in out-of-bounds memory access, enabling potential arbitrary code execution or denial of service. The vulnerability is rated critical with a CVSS 3.1 score of 9.8 (Network attack vector, low attack complexity, no privileges or user interaction required, high confidentiality, integrity, and availability impact). No patch or official remediation guidance is currently available from the vendor or CERT advisory.

Successful exploitation of this vulnerability can lead to arbitrary code execution or denial of service on the Orthanc DICOM Server due to heap buffer overflow. The attacker can cause memory corruption by exploiting the integer overflow in pixel length validation, potentially compromising the confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is released, consider restricting access to the Orthanc DICOM Server from untrusted networks and avoid processing untrusted PALETTE COLOR DICOM images. Monitor vendor communications for updates.