Critical Orthanc DICOM Server Vulnerability Threatens Healthcare Imaging Systems
A critical vulnerability (CVE-2026-87020) has been discovered in Orthanc DICOM Server versions prior to 1.13.0, affecting healthcare systems worldwide. The vulnerability stems from an integer overflow in pitch and buffer-size computation that leads to a heap out-of-bounds write when the server processes maliciously crafted PNG or JPEG images. Authenticated remote attackers can exploit this flaw to crash the Orthanc process, causing denial-of-service conditions that disrupt medical imaging operations. The vulnerability has been assigned a CVSS score of 8.1 (High), indicating significant risk to healthcare infrastructure. With medical imaging systems being critical components of healthcare delivery, this vulnerability poses substantial operational risks including disrupted patient care, delayed diagnoses, and potential compliance violations under HIPAA and other healthcare regulations. This vulnerability highlights the growing threat landscape targeting healthcare infrastructure, particularly as medical devices become increasingly connected and digitized. The timing coincides with heightened scrutiny of healthcare cybersecurity following recent high-profile attacks on medical facilities and increased regulatory focus on protecting patient data and ensuring continuity of care.
Kill Chain