Vulnerabilities Found in Orthanc DICOM Server Software

LONDON (AP) — Multiple heap buffer overflow vulnerabilities have been identified in the Orthanc DICOM Server software, a widely used open-source tool for medical imaging data management. The security flaws were disclosed on April 9, 2026, raising concerns among healthcare providers and IT administrators who rely on the platform for storing and transmitting digital medical records.

Orthanc is a lightweight, open-source DICOM server that enables hospitals and clinics to manage medical images such as X-rays, MRIs, and CT scans. The software is designed to facilitate the storage, retrieval, and sharing of these critical diagnostic files across healthcare networks. The newly discovered vulnerabilities could potentially allow attackers to execute arbitrary code or crash the server, disrupting access to patient data.

The developers and maintainers of Orthanc have acknowledged the issues and are working to address them. No specific details regarding the nature or severity of the vulnerabilities have been released publicly, though the term "heap buffer overflow" typically indicates a flaw in memory management that can be exploited to overwrite data or inject malicious code.

Healthcare institutions using Orthanc are advised to monitor for updates and apply patches as soon as they become available. The timing of the disclosure coincides with increased scrutiny of cybersecurity in the healthcare sector, where breaches can have life-threatening consequences.

The vulnerabilities were discovered during routine security assessments, though the exact circumstances of the discovery remain unclear. No confirmed incidents of exploitation have been reported as of the disclosure date. However, security experts warn that the potential for exploitation exists, particularly in unpatched systems.

Orthanc's development team has not specified whether the vulnerabilities affect all versions of the software or only specific releases. Users are urged to check their system configurations and consult official documentation for guidance on mitigation.

The medical imaging industry relies heavily on standardized protocols like DICOM to ensure interoperability between different systems and devices. Any compromise of these systems could undermine trust in digital health infrastructure and expose sensitive patient information.

As of now, there is no confirmed timeline for the release of a patch. The developers have not indicated whether the vulnerabilities were reported by an external researcher or discovered internally. Questions remain about the scope of the issue and whether other components of the Orthanc ecosystem are affected.

Healthcare organizations are encouraged to review their security protocols and consider additional safeguards while awaiting a resolution. The incident underscores the ongoing challenges of securing critical infrastructure in an increasingly connected digital environment.