# Heap Overflow in Orthanc DICOM Server Puts Medical Imaging Infrastructure at Risk
## The Threat
Orthanc — the open-source DICOM server that quietly underpins radiology workflows, PACS integrations, and medical imaging research at hospitals worldwide — has a heap out-of-bounds write vulnerability that any authenticated user can trigger by submitting a crafted PNG or JPEG image. The flaw lives in how Orthanc computes the pitch and buffer size when decoding image data: an integer overflow in that calculation causes the server to write past the end of a heap allocation, crashing the process outright.
The practical consequence is a reliable denial-of-service against the DICOM server. An attacker with valid credentials — which in many clinical environments means any staff member with access to the imaging system, or any researcher account on an academic deployment — can bring down the service by uploading a specially constructed image file. In hospital settings, Orthanc often sits at the center of imaging workflows; taking it down doesn't just break a software service, it interrupts access to radiology records.
Reported to CISA by researcher Andrej Tomci, the vulnerability affects all Orthanc releases before 1.13.0 and was published on September 10, 2026. No public exploit code or active exploitation has been reported yet — but the authentication bar is low, the crash is reproducible, and DICOM servers have a long history of sitting inadequately protected inside hospital networks.
## Severity and Impact
| Field | Detail |
|---|---|
| CVE | CVE-2026-87020 |
| CWE | CWE-190 — Integer Overflow or Wraparound |
| CVSS 3.1 Score | 8.1 HIGH |
| CVSS 3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| CVSS 4.0 Score | 7.2 HIGH |
| CVSS 4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Authentication Required | Low privilege (authenticated user) |
| Confidentiality Impact | None |
| Integrity Impact | High |
| Availability Impact | High |
The high integrity and availability impact scores reflect that a heap out-of-bounds write can be chained in some scenarios — what presents as denial-of-service today may prove exploitable for code execution under different conditions or with additional research.
## Affected Products
- All versions prior to 1.13.0
## Mitigations
Primary fix: Update to Orthanc DICOM Server v1.13.0 immediately. Downloads are available at [orthanc.uclouvain.be/downloads](https://orthanc.uclouvain.be/downloads/index.html).
Organizations that cannot patch immediately should apply the following compensating controls:
## References
---
## HackWire Analysis
The framing of this vulnerability as "only" a denial-of-service understates what a DICOM server outage means inside a working hospital. Radiologists cannot read studies. Emergency physicians cannot access prior imaging. Surgical teams lose access to pre-op scans. In a high-acuity environment, even a two-hour Orthanc outage cascades into delayed diagnoses and diverted procedures. The CVSS score captures the technical severity; it doesn't capture the clinical blast radius.
What makes this particularly sharp is the authentication requirement: low privilege, not administrator. Orthanc is widely deployed in academic medical centers, research hospitals, and smaller community facilities where imaging access is broadly provisioned. The attack surface isn't just a disgruntled insider — it's any compromised staff credential, any phished radiology tech account, any lateral movement from a general hospital workstation.
There's a pattern worth naming here: medical imaging infrastructure keeps surfacing as soft underbelly. DICOM as a protocol was designed for interoperability, not security. Open-source PACS solutions like Orthanc fill a real need in resource-constrained settings, but they often run unpatched for months because clinical uptime requirements make maintenance windows rare. The combination of broad network access inside hospital VLANs, weak patching discipline, and low authentication requirements is exactly the threat model that ransomware groups have learned to exploit.
The integer overflow class (CWE-190) in image-parsing code is also worth flagging to security teams doing internal audits. Any component that ingests DICOM, HL7, or imaging data and performs arithmetic on image dimensions, pixel depths, or buffer allocations deserves a second look. This won't be the last one.
Patch now. If you can't patch now, isolate the server and audit your credential inventory before end of week.
— HackWire Editorial
---
## Related Coverage