CVE-2026-5442

CVE-2026-5442 is a critical heap buffer overflow vulnerability in DICOM image decoders that results from improper encoding of dimension fields using Unsigned Long (UL) instead of Unsigned Short (US) value representation. This flaw permits attackers to specify extremely large image dimensions, triggering an integer overflow during frame size calculation and enabling out-of-bounds memory access during image decoding. The vulnerability affects any systems utilizing vulnerable DICOM parsing libraries and medical imaging applications that process untrusted DICOM files. The vulnerability carries a CVSS score of 9.8 CRITICAL with a network-based attack vector requiring no authentication, special privileges, or user interaction. The exploitation is straightforward due to low attack complexity, and successful compromise results in complete confidentiality, integrity, and availability impact. The attack surface is particularly concerning given that DICOM files are commonly shared across healthcare networks and imaging systems. Currently, CVE-2026-5442 is not listed on the Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. However, the extremely low EPSS score of 0.000620 indicates lower real-world exploitation probability at present, and the vulnerability remains on inactive status in threat tracking lists. Organizations should nonetheless prioritize patching due to the critical severity rating and ease of exploitation, particularly in healthcare environments where DICOM image processing is prevalent.