CVE-2026-5443

A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images. Pixel length validation uses 32-bit multiplication for width and height calculations. If these values overflow, the validation check incorrectly succeeds, allowing the decoder to read and write to memory beyond allocated buffers.

• CWE-787

• https://kb.cert.org/vuls/id/536588Third Party Advisory, VDB Entry
• https://www.machinespirits.de/Not Applicable
• https://www.orthanc-server.com/Product

Published

Apr 9, 2026

Last Modified

Oct 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54424An Incorrect Use of Privileged APIs vulnerability in Unity P…8.4
• CVE-2026-54425Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache…7.5
• CVE-2026-54426Uncontrolled recursion in the Redis reply parser in Apache b…7.5
• CVE-2026-54427Uncontrolled recursion in the AMF parser in Apache bRPC < 1.…7.5
• CVE-2026-54428Allocation of resources without limits or throttling in the …7.5
• CVE-2026-54429A vulnerability has been identified in SIMATIC S7-PLCSIM Adv…7.4
• CVE-2026-54430liboauth2 is vulnerable to Server-Side Request Forgery in oa…5.1
• CVE-2026-54431In liboauth2 the Demonstrating Proof-of-Possession (DPoP) ve…5.1
• CVE-2026-54432Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allow…4.7
• CVE-2026-54433In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, t…10
• CVE-2026-5444A heap buffer overflow vulnerability exists in the PAM image…7.1
• CVE-2026-54442Emissary is a P2P based data-driven workflow engine. Prior t…4.8