PT-2026-31631 · Unknown · Dicom Image Decoder

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-5442

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DICOM image decoder (affected versions not specified)

Description A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimension fields are encoded using Value Representation (VR) Unsigned Long (UL), instead of the expected VR Unsigned Short (US), allowing extremely large dimensions to be processed. This causes an integer overflow during frame size calculation, resulting in out-of-bounds memory access during image decoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-5442

Affected Products

Dicom Image Decoder

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-5442 · Security Note
• https://ubuntu.com/security/CVE-2026-5442 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5442 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-5442 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5442 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5442 · Vendor Advisory
• https://kb.cert.org/vuls/id/536588 · Note
• https://twitter.com/VulmonFeeds/status/2042336495546114270 · Twitter Post
• https://orthanc-server.com · Note
• https://machinespirits.de · Note
• https://twitter.com/CVEnew/status/2042302822532989031 · Twitter Post