Heap Overflow Flaw Found in Orthanc DICOM Upload
Researchers found a DICOM parsing flaw that can create a heap overflow in Orthanc when malformed images are uploaded, producing an out-of-bounds write during decoding.
Security researchers published a white paper on May 28, 2026, describing a DICOM parsing flaw that can trigger a heap overflow in Orthanc while an image is being uploaded.
The paper demonstrates a crafted DICOM file that causes an out-of-bounds write during decoding, overwriting memory outside the intended buffer. The condition arises during the normal image upload flow to an Orthanc server rather than through a separate service or protocol.
DICOM is the standard hospitals use to store and share medical images, and PACS servers often accept files automatically over a network. Those automated uploads can deliver malformed files directly to decoders, which must handle nested structures and multiple encoding options.
A heap overflow is a form of memory corruption that occurs when data is written past the allocated area on the heap. An out-of-bounds write can corrupt program state, cause crashes, or in some circumstances be used as a step in a broader exploit. The paper focuses on how the DICOM file structure and the server’s upload handling produce the overflow, not on any post-exploitation payload.
The authors note that DICOM’s many optional encodings and complex structures increase the likelihood that edge cases remain unhandled by decoders. Decoders process complex, structured input and therefore can expose attack surface when they accept untrusted files.
The white paper is presented as a proof of concept and does not report active exploitation campaigns. It does not state whether a patch has been released. Institutions that operate DICOM servers are advised to review vendor advisories, apply available security updates, and consider restricting automatic acceptance of untrusted DICOM files until parsing behavior is confirmed safe.
DICOM stands for Digital Imaging and Communications in Medicine. PACS, or picture archiving and communication systems, manage medical images in clinical environments. Researchers have examined DICOM parsers for years to identify robustness issues that could lead to memory corruption or other failures.
Articles by this author
