CVE-2026-5443

A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images. Pixel length validation uses 32-bit multiplication for width and height calculations. If these values overflow, the validation check incorrectly succeeds, allowing the decoder to read and write to memory beyond allocated buffers.

• CWE-787

• https://kb.cert.org/vuls/id/536588Third Party Advisory, VDB Entry
• https://www.machinespirits.de/Not Applicable
• https://www.orthanc-server.com/Product

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54421In OpenStack Ironic before 37.0.1, when applying a PATCH to …6.8
• CVE-2026-54422In OpenStack Ironic Python Agent through 11.5.0, a malicious…5.5
• CVE-2026-54423In OpenStack Ironic before 37.0.1, an Ironic user with the a…8.2
• CVE-2026-54424An Incorrect Use of Privileged APIs vulnerability in Unity P…8.4
• CVE-2026-54428Allocation of resources without limits or throttling in the …7.5
• CVE-2026-54429A vulnerability has been identified in SIMATIC S7-PLCSIM Adv…7.4
• CVE-2026-54430liboauth2 is vulnerable to Server-Side Request Forgery in oa…5.1
• CVE-2026-54431In liboauth2 the Demonstrating Proof-of-Possession (DPoP) ve…5.1
• CVE-2026-54432Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allow…4.7
• CVE-2026-54433In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, t…10
• CVE-2026-5444A heap buffer overflow vulnerability exists in the PAM image…7.1
• CVE-2026-54443Dashy is a self-hostable personal dashboard. From 1.9.4 unti…5.9