Description

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-11T15:17:06.937Z",
  "pubdate": "2026-09-11T15:17:06.937Z",
  "executiveSummary": "A critical security vulnerability exists within the Orthanc DICOM Server's image processing module during the decoding of malformed PNG files.\nThe vulnerability is characterized as an integer overflow during the calculation of pitch and buffer-size parameters, which subsequently facilitates a heap-based out-of-bounds write operation.\nSuccessful exploitation of this flaw can allow an unauthenticated attacker to corrupt memory segments, potentially leading to arbitrary code execution or a denial-of-service state.\nThe attack is triggered by supplying a specially crafted PNG file to the server, which the application attempts to process.\nGiven that Orthanc is frequently utilized in sensitive medical imaging environments, the potential for unauthorized data access or system disruption poses a significant risk to clinical workflows and data integrity.\nExploitation requires the attacker to successfully deliver the malicious payload to the Orthanc service, which may be accessible via network interfaces, necessitating strict boundary controls.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper integer arithmetic operation performed during the calculation of image dimensions and subsequent buffer allocations within the PNG decoding logic of the Orthanc DICOM Server.\nSpecifically, the application fails to perform adequate bounds checking or overflow validation when determining the necessary memory requirements for storing the decoded image data, specifically regarding the 'pitch' (the number of bytes representing a single row of pixels) and the total 'buffer-size'.\nAn attacker can manipulate the header information within a malicious PNG file to provide dimensions that, when processed, result in an integer overflow during the allocation size calculation.\nThis overflow causes the allocated memory buffer on the heap to be significantly smaller than the actual data being written into it, leading to a heap-based out-of-bounds write condition.\nThe attack flow commences when the Orthanc server receives a malformed PNG via its API or DICOM reception protocols. The decoding component extracts the malicious image parameters, performs the flawed arithmetic, and proceeds to allocate an undersized heap buffer.\nSubsequent pixel data decoding procedures then perform memory copy operations into the insufficient buffer space. This allows the attacker to overwrite adjacent heap metadata or critical data structures.\nFrom an exploitation perspective, this out-of-bounds memory write provides a primitive that can be leveraged by sophisticated adversaries to overwrite function pointers or other sensitive objects within the heap.\nThis can redirect program control flow, leading to the execution of arbitrary machine code in the context of the Orthanc process.\nBecause Orthanc often runs with privileges necessary to access DICOM repositories and system resources, successful execution could yield full control over the service instance.\nThe vulnerability does not strictly require authentication, assuming the attacker has network access to the Orthanc service, making this a high-severity concern for exposed instances."
}