Junglewise Threat Intelligence

CVE-2026-10528: Orthanc DICOM Server stack overflow in DCMTK Parser

CVE-2026-10528 · Severity: low · CVSS 3.3 · Published 2026-06-02

Executive brief

Orthanc DICOM Server, a popular open-source server for managing medical imaging data, is vulnerable to a denial-of-service attack. By submitting a specially crafted medical image (DICOM file) containing deeply nested data structures, an attacker can cause the server to crash. This results in a complete loss of availability for imaging services until the server is manually restarted, potentially disrupting clinical operations.

Technical details

A stack-based buffer overflow exists in Orthanc DICOM Server up to version 1.12.11 due to unbounded recursion when parsing deeply nested Sequence of Items (SQ) in DICOM files. The vulnerability is present in the DCMTK Parser component, specifically within the DcmItem::read function in FromDcmtkBridge.cpp. While some advisories categorize this as a local attack, the underlying bug report confirms it can be triggered remotely via a POST request to the /instances endpoint. An attacker can provide a small (approx. 2.3 KB) crafted DICOM file to exhaust the stack of the worker thread, crashing the entire Orthanc process. A patch (bae99026ca97) has been released which implements a recursion depth limit of 64 levels.

Affected products

  • Orthanc Orthanc DICOM Server up to 1.12.11

Timeline

  • 2026-04-26: disclosed: Vulnerability reported to Orthanc maintainers by Jose Lopez Martinez.
  • 2026-05-06: patched: Fix implemented in commit bae99026ca97.
  • 2026-06-02: advisory: CVE-2026-10528 published.

References