VulnSocial

CVE-2026-87020Patch

MEDIUMCVSS 7.2 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-190

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Peaked 2d ago at 1 mentions (2026-09-10); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-10: 1Mentions · 2026-09-12: 1Mentions · 2026-09-14: 1Active Exploitation · 2026-09-10: 1Patch / Workaround · 2026-09-12: 1Patch / Workaround · 2026-09-14: 1Technical Details · 2026-09-10: 1Technical Details · 2026-09-12: 1Technical Details · 2026-09-14: 109-1009-1209-14
Signal classification2 categories
Patch
266.7%
Active Exploitation
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-101
Active Exploitation1
2026-09-121
Patch1
2026-09-141
Patch1
Full discourse3 posts
  • CyberWorldOps@CyberWorldOps
    Patch

    CISA warns of CVE-2026-87020 in Orthanc DICOM Server: authenticated attackers can corrupt heap memory via crafted PNG/JPEG. Hospitals should patch now and restrict upload access. #HealthcareSecurity #InfoSec #Vulnerability https://cyberworldops.eu/en/orthanc-dicom-server-flaw-allows-authenticated-attackers-to-corrupt

    Post summary

    A CISA warning about CVE-2026-87020 in Orthanc DICOM Server describes a heap memory corruption vulnerability via crafted images and includes an explicit call to patch immediately.

    0000039
    10 followersView on X
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-87020 (CVSS 8.1) affects Orthanc DICOM Server with a PNG decoding flaw. Healthcare organizations using it should review patch status promptly: https://nvd.nist.gov/vuln/detail/CVE-202… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/6aJ7KSGvbb

    Post summary

    Orthanc DICOM Server is vulnerable to a PNG decoding flaw (CVE-2026-87020, CVSS 8.1). Healthcare organizations should immediately check patch status; no evidence of active exploitation or PoC is mentioned.

    0000042
    95 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows authenticated attackers are exploiting CVE-2026-87020 to crash Orthanc DICOM servers by uploading malicious PNG/JPEG images. The integer overflow triggers heap corruption, disrupting medical imaging operations across healthcare facilities. #Healthcare #Vulnerability :link: Full breakdown: https://aviatrix.ai/threat-research-center/orthanc-dicom-server-cve-2026-87020-heap-overflow-vulnerability-2026

    Post summary

    Authenticated attackers are currently exploiting CVE-2026-87020, using malicious PNG/JPEG images to trigger an integer overflow heap corruption that crashes Orthanc DICOM servers, impacting healthcare facilities.

    0000067
    2.0K followersView on X

Explore more

Back to dashboard