CVE-2026-87020 Orthanc CVE debrief

Who should care

Defenders responsible for Orthanc DICOM Server configurations and security should assess potential exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update Orthanc DICOM Server software versions.

Why it matters

CVE-2026-87020 is a high-severity vulnerability in Orthanc DICOM Server's PNG decoding process. Defenders should prioritize verifying configurations, reviewing PNG decoding processes, and assessing potential exposure to malicious PNG files.

• Potential for heap out-of-bounds write
• PNG decoding process vulnerability
• Orthanc DICOM Server configuration review required

Technical summary

The vulnerability occurs in the Orthanc DICOM Server's PNG decoding process, where an integer overflow leads to a heap out-of-bounds write. This can be exploited by an attacker-supplied PNG file. The vulnerability has a CVSS score of 7.2 and is considered HIGH severity. Defenders should prioritize verifying configurations, reviewing PNG decoding processes, and assessing potential exposure to malicious PNG files without unsupported root-cause or exploit claims. The CVE record was published on 2026-09-11T15:17:06.937Z and has not been modified since then.

Defensive priority

Defenders should prioritize verifying Orthanc DICOM Server configurations, reviewing PNG decoding processes, and assessing potential exposure to malicious PNG files.

Recommended defensive actions

• Verify Orthanc DICOM Server configurations and review PNG decoding processes
• Assess potential exposure to malicious PNG files
• Review and update Orthanc DICOM Server software versions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The Orthanc vendor is listed as the source of the vulnerability information. Evidence is limited to public CVE and NVD details. Defenders should verify Orthanc DICOM Server configurations and review PNG decoding processes for potential exposure to malicious PNG files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.