CVE-2026-5444

CVE-2026-5444 is a heap buffer overflow vulnerability in Orthanc's PAM image parsing functionality that occurs when processing specially crafted PAM images embedded within DICOM files. The flaw stems from a 32-bit integer overflow during image dimension calculations, which results in undersized buffer allocation followed by excessive write operations during pixel processing. This vulnerability affects Orthanc's image processing pipeline when handling malicious DICOM files containing embedded PAM image data. The vulnerability carries a CVSS score of 7.1 (HIGH) with a local attack vector requiring no privileges but user interaction. The attack has low complexity and impacts system integrity and availability, though not confidentiality. The exploit requires local file access and user action to process a crafted DICOM file, making it a practical but not remotely exploitable threat. CVE-2026-5444 is not currently listed on the Known Exploited Vulnerabilities catalog and shows no signs of active exploitation in the wild. The EPSS score of 0.00014 indicates minimal probability of exploitation relative to the broader CVE landscape. Community attention appears limited, with the vulnerability maintaining an inactive status on public vulnerability hot lists, though the moderate FAUCET risk score of 46.0 suggests organizations using Orthanc should still prioritize patching.