en
Orthanc is a Belgian open-source project that develops a lightweight DICOM server for healthcare and medical research. Its core purpose is to store, manage, query, transfer, and expose medical imaging data through standalone and extensible deployments. It serves healthcare and research organizations that need a compact DICOM infrastructure component.
As of 09/18/2026, Orthanc recorded 1 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, DICOM Server had the most security vulnerabilities in the Orthanc ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-87020Orthanc DICOM Server Integer Overflow or Wraparound | Exploitation statusNot known exploited | FixYes | Affected productDICOM Server | Published09/11/2026 | SeverityHigh |
CVE-2026-10528Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-based overflow | Exploitation statusPublic exploit | FixYes | Affected productDICOM Server | Published06/02/2026 | SeverityMedium |
CVE-2026-10173Orthanc Explorer 2 URL StudyList.vue cross site scripting | Exploitation statusPublic exploit | FixYes | Affected productExplorer 2 | Published05/31/2026 | SeverityMedium |
CVE-2026-5439Memory Exhaustion via Forged ZIP Metadata | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityHigh |
CVE-2026-5437Out-of-Bounds Read in DicomStreamReader | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityHigh |
CVE-2026-5438Gzip Decompression Bomb via Content-Encoding Header | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityHigh |
CVE-2026-5440Memory Exhaustion via Unbounded Content-Length | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityHigh |
CVE-2026-5442Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityCritical |
CVE-2026-5443Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode) | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityCritical |
CVE-2026-5445Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable) | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityCritical |
CVE-2026-5444Heap Buffer Overflow in PAM Image Buffer Allocation | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityHigh |
CVE-2026-5441Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression) | Exploitation statusNot known exploited | FixNot confirmed | Affected productDICOM Server | Published04/09/2026 | SeverityHigh |
CVE-2025-0896Orthanc Server Missing Authentication for Critical Function | Exploitation statusNot known exploited | FixYes | Affected productOrthanc server | Published02/13/2025 | SeverityCritical |
CVE-2023-7238Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer | Exploitation statusNot known exploited | FixYes | Affected productOsimis DICOM Web Viewer | Published01/23/2024 | SeverityHigh |
