Orthanc DICOM Server <1.13.0 Suffers Heap Overflow from PNG Decode – CVE‑2026‑87020

Orthanc DICOM Server, a widely deployed imaging platform used in hospitals and research facilities, has been found to contain a serious integer‑overflow flaw in its image‑decoding routine. Versions prior to 1.13.0 allow an authenticated attacker to craft a PNG or JPEG file that triggers a heap out‑of‑bounds write, crashing the Orthanc process and resulting in a denial‑of‑service (DoS) condition.

What the Vulnerability Looks Like

• CVE‑2026‑87020 – Integer overflow in pitch and buffer‑size calculation during PNG decode.
• Exploitable only by users who can authenticate to the Orthanc instance.
• Leads to a heap write beyond the allocated buffer, causing the server to crash.
• CVSS v3 score: 8.1 (High), CVSS v4 score: 7.2 (High).

Why It Matters for Healthcare

Orthanc is a critical component in many medical imaging workflows, and a DoS on the server can interrupt patient diagnostics and treatment. The vulnerability is especially concerning for public‑health institutions that rely on uninterrupted image access during emergencies.

Mitigation Steps

• Update to Orthanc 1.13.0 or later – the patch removes the vulnerable calculation.
• Restrict network exposure: place the Orthanc server behind a firewall and limit inbound connections to trusted IP ranges.
• If remote access is required, enforce VPN or other secure tunnels; keep VPN software up to date.
• Conduct a risk assessment to determine if the server can be isolated from the public network.
• Monitor logs for failed authentication attempts and anomalous image uploads.

"The flaw was reported by security researcher Andrej Tomci to CISA and has been classified as a high‑severity risk to healthcare infrastructure worldwide," notes the advisory.

Bottom Line

Healthcare providers and public‑health agencies that run Orthanc should act swiftly: upgrade immediately, harden network access, and monitor for suspicious activity. A quick patch can eliminate a DoS vector that could otherwise disrupt critical imaging services.