Ics-Medical - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/ics-medical/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 10 Sep 2026 16:06:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHeap Out-of-Bounds Write Vulnerability in Orthanc DICOM Serverhttps://feed.craftedsignal.io/briefs/2026-09-orthanc-dicom-dos/Thu, 10 Sep 2026 16:06:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-orthanc-dicom-dos/An integer overflow vulnerability (CVE-2026-87020) in Orthanc DICOM Server versions prior to 1.13.0 allows an authenticated remote attacker to cause a denial-of-service via a crafted PNG or JPEG image.Orthanc DICOM Server versions prior to 1.13.0 are susceptible to a heap out-of-bounds write vulnerability, tracked as CVE-2026-87020. The vulnerability stems from an integer overflow in the pitch and buffer-size computation logic when the server decodes PNG or JPEG images. An authenticated remote attacker can exploit this flaw by submitting a specially crafted image file to the DICOM server. Successful exploitation results in memory corruption, leading to a process crash and a denial-of-service (DoS) condition. This vulnerability poses a significant risk to healthcare environments where Orthanc is deployed to manage sensitive medical imaging data, as the crash disrupts the availability of critical imaging services. Organizations are advised to update to version 1.13.0 to remediate this flaw.

Impact

The vulnerability affects the Healthcare and Public Health sector globally. A successful attack results in the termination of the Orthanc service, preventing clinicians and medical systems from accessing or processing DICOM imagery. Given the dependency of modern radiology workflows on PACS and image management servers like Orthanc, this disruption can directly impact patient care and diagnostic throughput.

Recommendation

  • Upgrade all instances of Orthanc DICOM Server to version 1.13.0 or later immediately to patch CVE-2026-87020.
  • Minimize network exposure by isolating DICOM servers from the public internet and ensuring access is restricted to authorized internal networks only.
  • Implement network segmentation to place medical imaging infrastructure behind firewalls, restricting direct communication between the DICOM server and non-essential business segments.
  • Enforce strict authentication controls for the Orthanc web API to reduce the likelihood of unauthenticated or unauthorized users submitting malicious payloads.
  • Monitor Orthanc application logs for recurring service restarts or unexpected process crashes that may indicate exploitation attempts.
]]>highadvisoryvulnerabilityics-medicaldos