{
  "cveId": "CVE-2026-5445",
  "url": "https://patchblox.com/security/cve/CVE-2026-5445",
  "summary": "CVE-2026-5445 is fixed in orthanc on 1 platform by DEBIAN-CVE-2026-5445 (version 1.12.10\u002Bdfsg-4), released April 9, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "orthanc: An out-of-bounds read vulnerability exists in the \u0060DecodeLookupTable\u0060 function within \u0060DicomImageDecoder.cpp\u0060",
  "description": "An out-of-bounds read vulnerability exists in the \u0060DecodeLookupTable\u0060 function within \u0060DicomImageDecoder.cpp\u0060. The lookup-table decoding logic used for \u0060PALETTE COLOR\u0060 images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image.",
  "published": "2026-04-09T15:16:16Z",
  "severity": "critical",
  "cvss": 9.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00678,
  "epssPercentile": 0.52539,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "orthanc",
      "release": "Debian 14",
      "fixedVersion": "1.12.10\u002Bdfsg-4",
      "fix": "DEBIAN-CVE-2026-5445",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-5445",
      "released": "2026-04-09T15:16:16Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}