CVE-2026-5441: DICOM Decoder Information Disclosure Flaw

CVE-2026-5441 Overview

An out-of-bounds read vulnerability exists in the DecodePsmctRle1 function of DicomImageDecoder.cpp. The PMSCT_RLE1 decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output.

Critical Impact

Attackers can exploit this vulnerability to leak sensitive heap memory contents through rendered DICOM image output, potentially exposing patient data or other sensitive information stored in memory.

Affected Products

• DICOM image processing implementations using the vulnerable DecodePsmctRle1 function
• Software utilizing the PMSCT_RLE1 (Philips Compression) decompression routine
• Medical imaging applications processing Philips-compressed DICOM files

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-5441 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-5441

Vulnerability Analysis

This out-of-bounds read vulnerability resides in the DICOM image decoding functionality, specifically within the DecodePsmctRle1 function responsible for handling the proprietary Philips PMSCT_RLE1 compression format. The decompression routine processes escape markers within compressed data streams but fails to implement proper boundary validation when these markers appear near the end of the allocated buffer.

When processing a maliciously crafted DICOM image containing specific escape sequences positioned at the buffer boundary, the decoder continues reading memory beyond the legitimate data region. This results in heap memory contents being incorporated into the decompressed image output, effectively creating an information disclosure channel through rendered medical images.

The vulnerability is particularly concerning in medical imaging contexts where DICOM files may be exchanged between healthcare systems, as the leaked heap data could contain sensitive patient information, authentication tokens, or other security-critical data resident in memory at the time of processing.

Root Cause

The root cause of this vulnerability is insufficient bounds checking in the DecodePsmctRle1 function when processing escape markers within PMSCT_RLE1 compressed data streams. The decompression logic does not validate that the current read position remains within the bounds of the input buffer before processing escape marker sequences, allowing reads to extend beyond the allocated memory region when specially crafted escape sequences are positioned at the buffer boundary.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious DICOM image file containing a carefully constructed PMSCT_RLE1 compressed data stream. The attack sequence involves:

1. Creating a DICOM file with the PMSCT_RLE1 transfer syntax
2. Positioning specific escape marker sequences at or near the end of the compressed data buffer
3. Delivering the malicious file to a vulnerable DICOM processing application
4. When the victim application decodes the image, heap memory beyond the buffer is read and incorporated into the rendered output
5. The attacker can then extract sensitive information from the resulting image data

This attack requires no authentication and can be triggered simply by having a vulnerable application process the malicious DICOM file. Additional technical details are available in the CERT Vulnerability Advisory.

Detection Methods for CVE-2026-5441

Indicators of Compromise

• Unusual DICOM files with abnormally large or malformed PMSCT_RLE1 compressed data segments
• DICOM images with visual artifacts or noise patterns that could indicate memory leakage
• Application crashes or memory access violations when processing DICOM files with Philips compression
• Log entries indicating buffer boundary errors in DICOM processing components

Detection Strategies

• Monitor DICOM processing applications for memory access violations or segmentation faults during image decoding operations
• Implement file integrity validation for incoming DICOM files, flagging those with unusual compression stream structures
• Deploy endpoint detection rules to identify attempts to process DICOM files with anomalous PMSCT_RLE1 data segments
• Enable heap corruption detection mechanisms in DICOM processing environments

Monitoring Recommendations

• Implement logging for all DICOM image processing operations, capturing file metadata and processing outcomes
• Monitor for unusual network traffic patterns involving DICOM file transfers to detect potential exploitation attempts
• Review rendered DICOM images for unexpected data patterns that could indicate heap data leakage
• Establish baseline metrics for DICOM processing behavior to identify anomalous decompression operations

How to Mitigate CVE-2026-5441

Immediate Actions Required

• Restrict processing of DICOM files with PMSCT_RLE1 (Philips Compression) transfer syntax until patches are applied
• Implement network segmentation to isolate DICOM processing systems from untrusted data sources
• Review and audit all DICOM file ingestion points to ensure proper input validation is in place
• Consider temporary disabling of automated DICOM processing pipelines that accept files from external sources

Patch Information

Organizations should consult with their DICOM software vendors for updated versions that address this vulnerability. Review the CERT Vulnerability Advisory for official guidance. For implementations based on Orthanc Server, consult the Orthanc Server Documentation for security updates.

Workarounds

• Configure DICOM processing applications to reject files using the PMSCT_RLE1 transfer syntax
• Implement pre-processing validation to scan DICOM files for malformed compression streams before decoding
• Deploy sandboxed environments for DICOM image processing to contain potential memory disclosure impacts
• Use Web Application Firewalls or content inspection proxies to filter DICOM files with suspicious characteristics

For organizations unable to immediately patch, implementing strict input validation on DICOM file sources and transfer syntaxes provides a temporary risk reduction measure while awaiting vendor updates.