Security1 publisher2 min readPublished
A crafted PNG crashes Orthanc DICOM servers running below 1.13.0
CISA's September 10 advisory says an authenticated user can push Orthanc's image decode past the end of a heap allocation. The stated outcome is a crash, and the only remedy listed is an upgrade to 1.13.0.
The Watch · Security desk
What happened
- CISA issued medical advisory ICSMA-26-253-02 on September 10, 2026, covering Orthanc DICOM Server, the Belgian open-source imaging server it lists as deployed worldwide in healthcare.
- CVE-2026-87020 sits in Orthanc's image decode path, where CISA describes an integer overflow in a pitch and buffer-size computation that produces a heap out-of-bounds write.
- CISA's summary puts the requirement at an authenticated remote attacker and the outcome at a crash of the Orthanc process and a denial-of-service condition.
- Every Orthanc DICOM Server release below 1.13.0 is listed as affected, and the vendor's advice is to update to 1.13.0.
- Andrej Tomci reported the flaw to CISA, which says no known public exploitation specifically targeting it has been reported to the agency.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Fixing this means moving the archive itself to a new build, so the choice is when to take the imaging server down rather than which setting to change in the meantime.
- exposure Since the gate is authentication rather than the network edge, risk tracks the account list: any user or integration able to hand Orthanc an image can also stop it.
- contradiction The advisory's own two descriptions disagree on file type, which matters to anyone planning to filter uploads by format instead of patching, because the filter would be built on the narrower claim.
- constraint With no severity score in the advisory, shops that queue patches by CVSS have nothing to sort on and have to rank this from the primitive and their own exposure.
The arithmetic is the defect. Orthanc computes a pitch and a buffer size for an incoming image, and a crafted PNG makes that computation wrap, so the allocation comes out smaller than the decoded pixels need and the decoder writes past the end of the heap block [3]. CISA files it under CWE-190, integer overflow or wraparound [5]. The attacker supplies the file and needs a valid session; the advisory's summary says authenticated remote attacker [4].
What CISA commits to is a crash of the Orthanc process and a denial-of-service condition [4]. The document makes no code-execution claim [14], and its Metrics section carries no CVSS vector or severity rating [10]. Read that as the advisory's assessment of impact, not as a property of the bug class: an out-of-bounds heap write driven by attacker-controlled size math is a memory-corruption primitive, and this write-up neither develops that nor rules it out.
The two halves of the advisory also scope the decode path differently. The summary names a PNG or JPEG image; the vulnerability description names only PNG [13]. Anyone reaching for a format filter or a proxy rule as an interim control is building on the narrower of the two sentences.
CISA's recommended practices here are the standard industrial-control set: keep the system off the internet, put it behind firewalls isolated from business networks, use a VPN when remote access is required [11]. That guidance is aimed at devices that should never take unsolicited input. An imaging archive takes images for a living. Segmentation raises the cost of reaching Orthanc's front door and does nothing about a defect reached after the credential check.
The fix is a version bump. Orthanc points users at v1.13.0, and no configuration change or vendor workaround appears alongside it [6]. Because every release below 1.13.0 is in scope [2], there is no recent-enough build to fall back on and no way to close this by touching a setting [12]. The download is already published [6], which is the whole shape of the decision: the mechanism is public in outline, the reporter went to CISA rather than to a proof of concept [8], and the patched release exists today.
What to watch
- A revision to ICSMA-26-253-02 that attaches a CVSS score or states whether the heap write goes beyond a crash.
- Public proof-of-concept code or scanner plugins for CVE-2026-87020, against CISA's current position that no exploitation has been reported.
- Vendor changelog or advisory text confirming whether the JPEG decode path is in scope alongside PNG.