CVE-2026-5445

CVE-2026-5445 is an out-of-bounds read vulnerability in the DecodeLookupTable function of DicomImageDecoder.cpp that affects DICOM image processing. The flaw exists because the palette color lookup-table decoding logic fails to validate pixel indices against the actual lookup table size, allowing attackers to craft malicious DICOM images that trigger out-of-bounds memory reads. The vulnerability carries a CRITICAL severity rating with a CVSS score of 9.1, reflecting its network-accessible attack vector, low complexity requirements, and absence of authentication or user interaction prerequisites. An exploit could expose sensitive heap memory contents through the decoded image output and potentially cause application denial of service, though code execution is not indicated. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the KEV catalog or CISA Hot List. The EPSS score of 0.00062 indicates this CVE ranks higher in exploitability than the vast majority of published vulnerabilities, though no public exploit code is currently documented. Organizations should prioritize patching based on their use of DICOM image processing systems, particularly in healthcare and medical imaging environments.