High-Severity Vulnerability in Orthanc DICOM Server Exposes Systems to DoS Attacks A critical vulnerability (CVE-2026-87020) has been discovered in Orthanc DICOM Server, a widely used open-source medical imaging server deployed in clinical and research environments. The flaw, rated 8.1 (CVSS v3.1) and 7.2 (CVSS v4.0), allows an authenticated remote attacker to trigger a heap out-of-bounds write by sending a maliciously crafted PNG or JPEG image file, leading to a denial-of-service (DoS) crash of the Orthanc process. The issue stems from an integer overflow in pitch and buffer-size calculations during image decoding. Penetration tester Andrej Tomci identified the vulnerability and reported it to the Cybersecurity and Infrastructure Security Agency (CISA). The flaw affects all versions of Orthanc DICOM Server prior to 1.13.0. A patch has been released in version 1.13.0, and users are urged to upgrade immediately. Additionally, restricting network access to Orthanc instances to trusted hosts only is recommended as a mitigation measure. Orthanc DICOM Server is a lightweight, standalone solution designed to enhance interoperability in medical imaging workflows, often serving as a gateway to existing PACS (Picture Archiving and Communication Systems). The vulnerability underscores the risks of unpatched medical software in critical healthcare infrastructure.