CISA Warns of High-Severity Heap Overflow in Orthanc DICOM Server

On September 10, 2026, CISA released an ICS Medical Advisory (ICSMA-26-253-02) detailing a high-severity vulnerability in Orthanc DICOM Server, a widely used open-source DICOM server for medical imaging. The vulnerability, tracked as CVE-2026-87020, is an integer overflow in a pitch and buffer-size computation that occurs when Orthanc decodes an attacker-supplied PNG or JPEG image. Successful exploitation can cause a heap out-of-bounds write, crashing the Orthanc process and resulting in a denial-of-service condition.

The advisory notes that the affected product is Orthanc DICOM Server versions prior to 1.13.0. The vulnerability has a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 score of 7.2 (High). The vector indicates network accessibility, low attack complexity, and requires low-privilege authentication, with no user interaction. The impact is high for both integrity and availability, but there is no confidentiality impact.

The vulnerability was reported to CISA by Andrej Tomci. Orthanc, headquartered in Belgium, has released version 1.13.0 to address the issue. CISA recommends that users update to the patched version immediately. As of the advisory's publication, no known public exploitation of this vulnerability has been reported.

Given the critical role of DICOM servers in healthcare environments, organizations using Orthanc should prioritize patching and review their network exposure to minimize risk.