CVE-2026-87020: Orthanc DICOM Server Buffer Overflow

CVE-2026-87020 Overview

CVE-2026-87020 is an integer overflow vulnerability [CWE-190] in the Orthanc DICOM Server. The flaw occurs during pitch and buffer-size computation when the server decodes an attacker-supplied Portable Network Graphics (PNG) image. The overflow produces an undersized allocation that leads to a heap out-of-bounds write. Orthanc is widely deployed in medical imaging environments to store, retrieve, and route Digital Imaging and Communications in Medicine (DICOM) studies. The Cybersecurity and Infrastructure Security Agency (CISA) tracks this issue in medical advisory ICSMA-26-253-02.

Critical Impact
An authenticated attacker delivering a crafted PNG to Orthanc's decoding path can corrupt heap memory, resulting in loss of integrity and availability of the DICOM server.

Affected Products

Orthanc DICOM Server (PNG decoding component)
Deployments exposing Orthanc REST or DICOMweb endpoints that accept PNG input
Downstream integrations that route attacker-influenced PNG data to Orthanc

Discovery Timeline

2026-09-11 - CVE-2026-87020 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-87020

Vulnerability Analysis

The vulnerability resides in Orthanc's PNG decoding routine, specifically in the arithmetic that computes the row pitch and total pixel-buffer size before allocation. When an attacker supplies crafted image dimensions or bit-depth values, the multiplication used to derive the allocation size wraps around the fixed-width integer boundary. The resulting truncated value causes Orthanc to allocate a heap buffer smaller than the pixel data the decoder subsequently writes.

During the copy or decode loop, the decoder uses the untruncated logical size, walking past the end of the allocated region. This produces a heap out-of-bounds write. The condition maps to [CWE-190] Integer Overflow or Wraparound, a well-understood class of image-parser flaw. Exploitation requires network access to an Orthanc instance and low privileges to submit an image for processing.

Root Cause

The root cause is missing overflow validation in the pitch and buffer-size calculation. Orthanc trusts image header fields such as width, height, and bytes-per-pixel without saturating arithmetic or explicit range checks before calling the allocator.

Attack Vector

An authenticated user submits a malicious PNG through an ingestion path that reaches Orthanc's PNG decoder. The crafted header triggers the undersized allocation and the subsequent out-of-bounds write to the heap. Successful exploitation can corrupt adjacent heap metadata or objects, degrading service integrity and availability.

No verified proof-of-concept code is publicly available. See the CISA ICS Medical Advisory and the GitHub CSAF JSON File for the authoritative technical description.

Detection Methods for CVE-2026-87020

Indicators of Compromise

Orthanc worker process crashes or restarts correlated with PNG upload or DICOM store operations.
Heap corruption signatures in core dumps or dmesg output from the Orthanc host.
Unusual PNG payloads with extreme width, height, or channel values arriving on Orthanc REST or DICOMweb endpoints.

Detection Strategies

Inspect Orthanc HTTP access logs for POST /instances and DICOMweb store requests carrying PNG content from unexpected accounts or source addresses.
Enable Address Sanitizer (ASan) in non-production Orthanc builds to surface out-of-bounds writes during regression testing.
Monitor for repeated 5xx responses from Orthanc endpoints that decode images, which can indicate exploitation attempts.

Monitoring Recommendations

Forward Orthanc application logs, host process telemetry, and network flows to a centralized analytics platform for correlation.
Alert on Orthanc service restarts outside of maintenance windows.
Baseline expected image sizes and dimensions in your imaging workflow, and flag statistical outliers reaching the decoder.

How to Mitigate CVE-2026-87020

Immediate Actions Required

Inventory all Orthanc DICOM Server instances, including containerized and embedded deployments in medical devices.
Upgrade Orthanc to the fixed release published on the Orthanc Download Index.
Restrict network reachability of Orthanc endpoints to trusted clinical networks and authenticated integration partners.
Rotate credentials for accounts with upload privileges if exploitation is suspected.

Patch Information

Refer to the Orthanc Download Index for the current maintained release that addresses the integer overflow in the PNG decoder. Coordinate deployment with medical device vendors when Orthanc is embedded in a regulated system. Track the coordinated advisory through the CISA ICS Medical Advisory.

Workarounds

Disable or block PNG ingestion paths where DICOM workflows do not require PNG input.
Place a reverse proxy or web application firewall in front of Orthanc to reject PNG payloads exceeding realistic dimension and size thresholds.
Enforce least-privilege authentication so only vetted service accounts can submit images to Orthanc.
Segment Orthanc hosts on isolated VLANs and restrict outbound connectivity to limit post-exploitation impact.

bash

# Example: reject oversized PNG uploads at an NGINX reverse proxy in front of Orthanc
http {
    client_max_body_size 50m;
    server {
        listen 443 ssl;
        location /instances {
            if ($content_type ~* "image/png") {
                # Optional: route PNG uploads through a stricter validator
                proxy_pass http://png-validator.internal;
            }
            proxy_pass http://orthanc.internal:8042;
        }
    }
}