CVE-2026-5439

CVE-2026-5439 is a memory exhaustion vulnerability affecting Orthanc's ZIP archive processing functionality. The flaw exists because Orthanc automatically extracts uploaded ZIP files while trusting uncompressed size values in file metadata without proper validation. An attacker can exploit this by uploading a small ZIP archive with falsified size information, triggering the server to allocate extremely large memory buffers during extraction and causing a denial of service. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The impact is limited to availability, with no confidentiality or integrity compromise. The attack can be executed remotely by any unauthenticated actor against vulnerable endpoints accepting ZIP uploads. There is currently no evidence of active exploitation in the wild, as this vulnerability is not present on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00055 indicates minimal exploitation probability relative to other CVEs. The moderate FAUCET Risk Score of 47.0 suggests community attention warrants patching, though immediate exploitation risk appears limited.