PT-2026-31630 · Unknown · Dicomimagedecoder

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-5441

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions DicomImageDecoder (affected versions not specified)

Description An out-of-bounds read issue exists in the DecodePsmctRle1 function within DicomImageDecoder.cpp. The PMSCT RLE1 decompression routine, used for decoding the Philips Compression format, does not validate escape markers correctly when they are near the end of the compressed data. A specifically crafted sequence at the end of the data can cause the decoder to read beyond the allocated memory, potentially leaking heap data into the image output.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-5441

Affected Products

Dicomimagedecoder

References · 11

• https://cve.org/CVERecord?id=CVE-2026-5441 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5441 · Security Note
• https://ubuntu.com/security/CVE-2026-5441 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5441 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5441 · Vendor Advisory
• https://kb.cert.org/vuls/id/536588 · Note
• https://machinespirits.de · Note
• https://orthanc-server.com · Note
• https://twitter.com/CVEnew/status/2042302826635055563 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042339055422099952 · Twitter Post