The Cybersecurity and Infrastructure Security Agency has warned of a high-severity vulnerability in Orthanc DICOM Server that can let an authenticated remote attacker crash the server by supplying a PNG or JPEG image. CISA identified the issue as CVE-2026-87020 in an advisory published September 10, 2026, and said successful exploitation can result in a denial-of-service condition. CISA lists Orthanc DICOM Server as the affected product and classifies it as known affected.

The flaw involves an integer overflow in a specified pitch and buffer-size computation. When Orthanc decodes an attacker-supplied PNG, the calculation can lead to a heap out-of-bounds write, according to the advisory. CISA’s summary also identifies attacker-supplied JPEG images as a possible input to the vulnerable image-decoding process.

The memory write can extend past the end of a heap allocation and cause the Orthanc process to crash. CISA describes the result as a denial-of-service condition. The vulnerability is identified under CWE-190, Integer Overflow or Wraparound.

The advisory’s CVSS 3.1 score is 8.1, rated high. Its vector lists a network attack vector, low attack complexity, low required privileges and no user interaction. The vector also indicates high potential impact to integrity and availability, with no confidentiality impact. The CVSS 4.0 score is 7.2, also rated high, and lists no confidentiality impact while assigning high potential impact to integrity and availability.

Exploitation requires authentication, according to the advisory’s CVSS vectors. The issue can be reached over a network, and exploitation does not require user interaction. CISA describes the threat as an authenticated remote attack.

Orthanc recommends updating to version 1.13.0. The advisory identifies that update as the mitigation and does not provide a list of earlier affected version numbers in the published product section.

Orthanc DICOM Server is associated with the healthcare and public health critical-infrastructure sector, and CISA lists its deployment as worldwide. The vendor’s headquarters location is listed as Belgium. Andrej Tomci is credited with reporting the vulnerability to CISA.

CISA said no known public exploitation specifically targeting CVE-2026-87020 had been reported at the time of publication. The agency recommends taking defensive measures to minimize the risk of exploitation. Those measures include minimizing network exposure for control-system devices and systems, ensuring they are not accessible from the internet, placing control-system networks and remote devices behind firewalls, and isolating them from business networks.

When remote access is required, CISA recommends more secure methods such as virtual private networks. The agency notes that VPNs may have vulnerabilities and should be updated to the most current version available. It also says organizations should consider the security of connected devices and conduct proper impact analysis and risk assessment before deploying defensive measures.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of industrial control system assets. Organizations that observe suspected malicious activity are directed to follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

The advisory was issued as an initial publication on September 10, 2026. The update to Orthanc version 1.13.0 is the stated remediation.