Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions

Description

// GetHeight() and GetWidth() return unsigned int (32-bit).
// GetHeight() * GetWidth() overflows in 32-bit before promotion to size_t.
// With Rows=65536, Cols=65536: 65536 * 65536 = 2^32 → truncated to 0
return (GetHeight() *
        GetWidth() *
        GetBytesPerValue() *
        GetChannelCount());

// memcpy uses declared width as pitch (65536),
// but the pixel data buffer is only 64 bytes
memcpy(target, source, pitch);

==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xffff9783ca20
READ of size 65536 at 0xffff9783ca20 thread T18
    #0 in __interceptor_memcpy
    #1 in memcpy                                        string_fortified.h:29
    #2 in Orthanc::ImageProcessing::Copy()              ImageProcessing.cpp:576
    #3 in Orthanc::ImageProcessing::Convert()           ImageProcessing.cpp:689
    #4 in Orthanc::DicomImageDecoder::DecodeUncompressedImage() DicomImageDecoder.cpp:607
    #5 in Orthanc::DicomImageDecoder::Decode()          DicomImageDecoder.cpp:827
    #6 in Orthanc::ParsedDicomFile::DecodeFrame()       ParsedDicomFile.cpp:1823
    #7 in Orthanc::ServerContext::DecodeDicomFrame()    ServerContext.cpp:1921

0xffff9783ca20 is located 0 bytes to the right of 64-byte region [0xffff9783c9e0,0xffff9783ca20)
allocated by thread T18 here:
    #0 in operator new[]
    #1 in DcmElement::newValueField()                   dcelem.cc:788

Impact

• Persistent denial of service: a single stored 876-byte DICOM crashes the Orthanc process every time any user requests its preview. Restart returns service but the malicious DICOM remains; any subsequent preview crashes the server again.
• Heap-read primitive: memcpy reads 65536 bytes from a 64-byte buffer, crossing into adjacent heap allocations. Code execution within the Orthanc process's authority has not been demonstrated; the primitive's shape (large, contiguous read of attacker-controlled length) makes it a plausible target for further exploitation research.
• Reachable unauthenticated for the planting step under Orthanc's default configuration (DicomAlwaysAllowStore: true); the trigger requires only a preview request from any read-level user.

Mitigation

Update Orthanc to version 1.12.11 or later. The fix performs both dimension validation at parse time (rejecting Rows/Columns values above 65535, the VR US ceiling) and 64-bit arithmetic with explicit overflow checks in GetFrameSize(). As immediate defense in depth, set DicomAlwaysAllowStore: false in orthanc.json and configure an AET allow-list, which closes the unauthenticated planting vector.

Defender's Checklist

• Verify your version.

  curl -u <user>:<pass> http://<orthanc>:8042/system | jq .Version — the patched range begins at 1.12.11.

• Close the unauthenticated C-STORE planting vector.

  Set DicomAlwaysAllowStore: false in orthanc.json and define an explicit DicomModalities allow-list of legitimate AETs. Otherwise any host that can reach port 4242 can plant the persistent crashing DICOM unauthenticated.

• Quarantine and review the DICOM store before patching.

  Search the store for studies whose Rows or Columns exceed 65535 — only possible with VR UL encoding and by construction malicious, since DICOM defines these tags as VR US (max 65535). Quarantine before patching, since the next preview request crashes the server.

• Audit who has preview access.

  Once a malicious study is stored, any read-level user requesting GET /instances/*/preview crashes the process. Limit preview access at your reverse proxy to the IPs of integration points and viewers that need it.

• Watch for crash-restart cycles tied to preview requests.

  Alert on Orthanc restarts (journalctl -u orthanc | grep -E 'SIGSEGV|killed') that closely follow GET /instances/*/preview log entries. Repeated crashes from the same study ID indicate a stored attack.

• Confirm crash recovery is configured.

  Until the store is purged of the malicious study, every preview crashes the process. Tight supervisor restart (systemd, Kubernetes liveness probes, Docker --restart) keeps service available between requests but does not mitigate the bug.

Severity Reasoning

References

• CVE-2026-5442 (NVD)
• VU#536588 (CERT/CC)
• Orthanc Fix Commit
• Vendor Release Announcement (v1.12.11)

How We Can Help

• DICOM Security Testing
• MDR Penetration Testing
• §17 MPBetreibV Compliance