DICOM Vulnerabilities in Orthanc Servers Allow Heap Overflows

Cisco Talos Blog researchers have detailed critical vulnerabilities within the DICOM file format parsing libraries, affecting the Orthanc PACS server. These weaknesses, specifically heap overflows, can be triggered by malformed DICOM files uploaded to the server. This presents a significant attack surface, as hospitals and medical institutions often ingest DICOM files automatically over networks, potentially leading to remote code execution.

The exploitation chain involves crafting malicious DICOM files that, when processed by vulnerable components like Pydicom or GDCM, cause out-of-bounds writes on the server’s heap. This technical deep dive highlights how complex, yet critical, medical imaging standards can harbor exploitable flaws that attackers can leverage during routine data ingestion processes.

Defenders should prioritize patching Orthanc servers and any systems relying on the identified DICOM parsing libraries. Given the sensitive nature of medical data and the potential for system compromise, a proactive approach to vulnerability management is essential. Network segmentation and input validation at ingress points can further mitigate risks, though direct patching remains the most effective defense.