CVE-2026-5443

CVE-2026-5443 is a critical heap buffer overflow vulnerability affecting DICOM image decoders, specifically during the processing of PALETTE COLOR images. The flaw stems from inadequate pixel length validation where 32-bit integer multiplication of width and height values can overflow, bypassing security checks and permitting out-of-bounds memory access. This vulnerability impacts any system or application utilizing vulnerable DICOM decoding libraries. The vulnerability carries a CVSS score of 9.8 (CRITICAL) with a network-based attack vector requiring no authentication or user interaction, indicating maximum severity. An attacker can remotely exploit this vulnerability to achieve high confidentiality, integrity, and availability impact, including potential arbitrary code execution. The EPSS score of 0.00062 suggests this threat remains relatively uncommon in the broader threat landscape at present. There is currently no evidence of active exploitation in the wild, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. While community attention appears limited given the inactive Hot List status, organizations using DICOM processing tools should prioritize patching once vendor fixes become available, given the trivial attack complexity and complete lack of prerequisites for exploitation.