Orthanc vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 202612

Newest CVEs

• CVE-2026-87020

  Orthanc DICOM Server Integer Overflow or Wraparound

  Orthanc · DICOM Server

  High7.2
• CVE-2026-10528

  Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-based overflow

  Orthanc · DICOM Server

  Medium4.8
• CVE-2026-10173

  Orthanc Explorer 2 URL StudyList.vue cross site scripting

  Orthanc · Explorer 2

  Medium5.3
• CVE-2026-5439

  Memory Exhaustion via Forged ZIP Metadata

  Orthanc · DICOM Server

  High7.5
• CVE-2026-5437

  Out-of-Bounds Read in DicomStreamReader

  Orthanc · DICOM Server

  High7.5
• CVE-2026-5438

  Gzip Decompression Bomb via Content-Encoding Header

  Orthanc · DICOM Server

  High7.5
• CVE-2026-5440

  Memory Exhaustion via Unbounded Content-Length

  Orthanc · DICOM Server

  High7.5
• CVE-2026-5442

  Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions

  Orthanc · DICOM Server

  Critical9.8
• CVE-2026-5443

  Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)

  Orthanc · DICOM Server

  Critical9.8
• CVE-2026-5445

  Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)

  Orthanc · DICOM Server

  Critical9.1