This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-87020 →

DEBIAN-CVE-2026-87020

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker...

Original description

The description as published by the source.

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 orthanc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 orthanc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 orthanc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org