Out-of-Bounds Read in DICOM Image Decoder (PMSCT_RLE1 Decompression)

Description

for (size_t i = 0; i < length; i++)
{
  if (inbuffer[i] == 0xa5)
  {
    temp.push_back(inbuffer[i+2]);    // OOB read if i >= length-2
    for (uint8_t repeat = inbuffer[i + 1]; repeat != 0; repeat--)
    {
      temp.push_back(inbuffer[i+2]);  // OOB read repeated up to 255 times
    }
    i += 2;
  }
  // ...
}

for (size_t i = 0; i < temp.size(); i++)
{
  if (temp[i] == 0x5a)
  {
    uint16_t v1 = temp[i + 1];       // OOB read if i >= temp.size()-1
    uint16_t v2 = temp[i + 2];       // OOB read if i >= temp.size()-2
    value = (v2 << 8) + v1;
    i += 2;
  }
  // ...
}

row 0: [  0,   0,   0,   0,   0,   0,   0,   0]
row 1: [  0,   0,   0,   0,   0,   0,   0,   0]
row 2: [  0,   0,   0,   0,   0,   0,   6,  12]
row 3: [ 18,  24,  30,  36,  43,  49,  55,  61]
row 4: [ 67,  73,  79,  85,  91,  97, 103, 109]
row 5: [115, 121, 128, 134, 140, 146, 152, 158]
row 6: [164, 170, 176, 182, 188, 194, 200, 206]
row 7: [213, 219, 225, 231, 237, 243, 249, 255]

==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xffffa5437348
READ of size 1 at 0xffffa5437348 thread T18
    #0 in std::vector<unsigned char>::push_back()      stl_vector.h:1192
    #1 in Orthanc::DicomImageDecoder::DecodePsmctRle1() DicomImageDecoder.cpp:195
    #2 in Orthanc::DicomImageDecoder::ImageSource::Setup() DicomImageDecoder.cpp:275
    #3 in Orthanc::DicomImageDecoder::DecodeUncompressedImage() DicomImageDecoder.cpp:558
    #4 in Orthanc::DicomImageDecoder::Decode()          DicomImageDecoder.cpp:827
    #5 in Orthanc::ParsedDicomFile::DecodeFrame()       ParsedDicomFile.cpp:1823
    #6 in Orthanc::ServerContext::DecodeDicomFrame()    ServerContext.cpp:1921

0xffffa5437348 is located 0 bytes to the right of 24-byte region [0xffffa5437330,0xffffa5437348)
allocated by thread T18 here:
    #0 in operator new[]
    #1 in DcmElement::newValueField()                   dcelem.cc:788

Impact

• Information disclosure of arbitrary heap memory via rendered preview images, with controlled amplification (one OOB byte repeated up to 256 times in the output) provided by the RLE repeat count.
• By varying the input payload size, the attacker scans different heap offsets across multiple crafted files, building a multi-byte heap dump.
• Reachable unauthenticated for the planting step under Orthanc's default configuration (DicomAlwaysAllowStore: true); the rendering step requires read-level authentication.
• On builds with strict heap layout (e.g. AddressSanitizer or hardened glibc), an OOB read may abort the process; on stock builds the typical outcome is a silent data leak.

Mitigation

Update Orthanc to version 1.12.11 or later. The fix adds bounds checks before every i+1/i+2 access in both passes, aborting decode with BadFileFormat when an escape marker is followed by insufficient data. As immediate defense in depth, set DicomAlwaysAllowStore: false in orthanc.json and configure an AET allow-list, which closes the unauthenticated planting vector.

Defender's Checklist

• Verify your version.

  curl -u <user>:<pass> http://<orthanc>:8042/system | jq .Version — the patched range begins at 1.12.11.

• Close the unauthenticated C-STORE planting vector.

  Set DicomAlwaysAllowStore: false in orthanc.json and define an explicit DicomModalities allow-list of legitimate AETs. Without this, any host that can reach port 4242 can plant the malicious DICOM unauthenticated.

• Restrict the preview endpoint.

  If your deployment does not require web preview, restrict GET /instances/*/preview at your reverse proxy. The OOB only becomes observable when something renders the malicious image.

• Audit who has read access.

  An attacker only needs read-level credentials to view the leaked heap data. Review RegisteredUsers in orthanc.json and any external authentication backend for stale or low-privilege accounts that should not have read access to arbitrary studies.

• Audit the DICOM store for PMSCT_RLE1 payloads.

  Search the store for studies that omit (7FE0,0010) PixelData but carry (0x07a1,0x1011) = "PMSCT_RLE1". Studies from sources outside your modality inventory or with unexpected payload sizes should be quarantined and reviewed before patching.

Severity Reasoning

References

• CVE-2026-5441 (NVD)
• VU#536588 (CERT/CC)
• Orthanc Fix Commit
• Vendor Release Announcement (v1.12.11)

How We Can Help

• DICOM Security Testing
• MDR Penetration Testing
• §17 MPBetreibV Compliance