2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"DICOM Server","vendor":"Orthanc","versions":[{"lessThanOrEqual":"1.12.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*","matchCriteriaId":"A259075D-8B77-4B04-BC42-3E5ABE9DFE1F","versionEndExcluding":"1.12.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output."},{"lang":"es","value":"Existe una vulnerabilidad de lectura fuera de límites en la función ’DecodePsmctRle1’ de ’DicomImageDecoder.cpp’. La rutina de descompresión ’PMSCT_RLE1’, que decodifica el formato de compresión propietario de Philips, no valida correctamente los marcadores de escape colocados cerca del final del flujo de datos comprimidos. Una secuencia manipulada al final del búfer puede hacer que el decodificador lea más allá de la región de memoria asignada y filtre datos del montón en la salida de la imagen renderizada."}],"id":"CVE-2026-5441","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5441","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T15:07:23.792857Z","version":"2.0.3"}}]},"published":"2026-04-09T15:16:16.443","references":[{"source":"cret@cert.org","tags":["Third Party Advisory","VDB Entry"],"url":"https://kb.cert.org/vuls/id/536588"},{"source":"cret@cert.org","tags":["Not Applicable"],"url":"https://www.machinespirits.de/"},{"source":"cret@cert.org","tags":["Product"],"url":"https://www.orthanc-server.com/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
|