Orthanc's Own Changelog Skips the Bug CISA Just Flagged

[An authenticated attacker who holds only low-level privileges] can crash an unpatched Orthanc DICOM Server, and potentially corrupt what it stores, by uploading a booby-trapped PNG or JPEG image, according to a CISA advisory published Sept. 11.

CISA tracks the flaw as CVE-2026-87020, an integer overflow in a pitch-and-buffer-size calculation that produces a heap out-of-bounds write when Orthanc decodes the malicious image. CISA rates it 8.1 out of 10 on the CVSS v3.1 scale and 7.2 on CVSS v4.0. Orthanc fixed it in version 1.13.0. Penetration tester Andrej Tomci reported the flaw through CISA's coordinated disclosure program for medical devices, and CISA says it has no reports of the bug being exploited.

Orthanc describes itself as a free, standalone, open-source DICOM server, used in clinical and research settings to complement or act as a gateway to existing hospital PACS imaging systems, according to HIPAA Journal.

What Orthanc's own changelog does not say

Orthanc shipped version 1.13.0 on Aug. 15, according to its release announcement, nearly four weeks before CISA's advisory. Orthanc's own NEWS changelog for that release names ten other CVE numbers it fixed in the same rewrite. It does not mention CVE-2026-87020 anywhere.

CVE	Credited to	Type
CVE-2026-10528	Jose Lopez Martinez, Deloitte	Denial of service via nested DICOM sequences
CVE-2026-5437 through 5445 (9 IDs)	Not credited in the changelog	Out-of-bounds read/write
CVE-2026-87020	Andrej Tomci, via CISA	Integer overflow, heap out-of-bounds write

Why one rewrite touched all eleven bugs at once

Orthanc's release announcement, posted by developer jodogne, describes 1.13.0 as "a complete rewrite of how DICOM files are retrieved from the storage area, parsed, and transcoded." That is the same code path an image-decoding overflow like CVE-2026-87020 would sit in, alongside the nested-sequence and out-of-bounds bugs the changelog does name, even though CISA's advisory is the only place the specific CVE number appears.

What sets this apart from other ICS advisories this month

Unlike NextGen Healthcare's Mirth Connect flaws or AVEVA's hardcoded encryption key, both catalogued by CISA earlier in September, CVE-2026-87020 requires an attacker to already hold a low-privilege authenticated account on the server. It is not open to anonymous scanning across the internet the way an unauthenticated ICS bug would be, which is part of why CISA has no exploitation reports for it.

What CISA and Orthanc have not clarified

Neither CISA's advisory nor Orthanc's own release notes say why this one flaw, out of eleven fixed in the same version, went through a formal coordinated disclosure while the other ten were folded into the changelog without individual attention.

What to do if you run Orthanc today

CISA's recommended mitigation, per HIPAA Journal's reporting on the advisory, is to verify the installed Orthanc version, upgrade to 1.13.0 or later, and restrict network access to Orthanc instances to trusted hosts only. Operators who cannot upgrade immediately should treat every account with write access to an Orthanc instance as a potential path to a crash, since CVE-2026-87020 needs only low privileges, not administrative ones, to trigger. The nine unnumbered out-of-bounds fixes in the same release carry the same practical advice even though CISA never gave them a public advisory of their own.