CVE-2026-10528
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Vulnerability in Orthanc DICOM Server up to version 1.12.11 in the DcmItem::read function of the DCMTK Parser component causes a stack-based buffer overflow via a local attack. Exploit has been published.
Risk Assessment
The risk involves potential local code execution or server crash, potentially disrupting medical systems.
Recommendation
Apply the patch named bae99026ca97 or update Orthanc DICOM Server.
Original NVD description (English source)
A security flaw has been discovered in Orthanc DICOM Server up to 1.12.11. This issue affects the function DcmItem::read of the file OrthancFramework/Sources/DicomParsing/FromDcmtkBridge.cpp of the component DCMTK Parser. Performing a manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named bae99026ca97. To fix this issue, it is recommended to deploy a patch.