A high-severity bug in the Orthanc DICOM server lets a logged-in attacker crash the software with one bad image file.
CISA disclosed CVE-2026-87020 on September 10, in Orthanc DICOM Server versions before 1.13.0. The bug is an integer overflow in how the software computes pitch and buffer size when decoding a PNG or JPEG image, causing a heap out-of-bounds write. An authenticated remote attacker can trigger it with a single malformed image, crashing the Orthanc process and knocking it offline. It scores 8.1 on CVSS 3.1 and 7.2 on CVSS 4.0, both rated high severity, and Orthanc has already shipped a fix in version 1.13.0.
Orthanc runs in hospitals and imaging centers worldwide, and CISA files this under the Healthcare and Public Health sector. A denial-of-service bug in medical imaging software is not just an IT headache; it can mean radiologists losing access to scans mid-shift. The attacker needs valid credentials first, which limits the blast radius, but plenty of DICOM servers sit on networks with weak internal access controls.
No public exploitation has been reported yet, so this is a patch-now, not panic situation, assuming your hospital's IT team is actually tracking Orthanc's release notes.