An authenticated attacker can knock an Orthanc DICOM Server off the network by feeding it a doctored image, thanks to a heap buffer flaw that crashes the process.
Hospitals, imaging centers, and research labs use the open-source server to bridge imaging systems and keep studies moving in front of, or beside, an existing PACS archive. When it decodes a specially crafted PNG or JPEG, an integer overflow in the pitch and buffer-size computation produces a heap out-of-bounds write that drops the process.
The bug is tracked as CVE-2026-87020, rated 8.1 under CVSS v3.1 and 7.2 under CVSS v4.0. Penetration tester Andrej Tomci reported it through CISA, and the project closed it in release 1.13.0. Anything older is exposed.
Imaging teams should confirm the version running in their environment, upgrade to 1.13.0 or later, and limit network reach to trusted hosts. Denial-of-service bugs rarely draw the attention ransomware does, yet a DICOM gateway sits on the diagnostic critical path. Taking one offline can stall reads, push back surgical planning, and send clinicians back to manual workarounds.
