CVE-2026-5441

Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)

High · published April 9, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape markers placed near the end of the compressed data stream. A crafted sequence at the end of the buffer can cause the decoder to read beyond the allocated memory region and leak heap data into the rendered image output.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00189 · 8.1th percentile
Published
2026-04-09T14:42Z
EPSS history
Timeline
  • 09 APR 14:42Z
    Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)
    cvelistv5