High severity7.5NVD Advisory· Published Apr 9, 2026· Updated Apr 15, 2026

CVE-2026-5439

Description

A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and trusts metadata fields describing the uncompressed size of archived files. An attacker can craft a small ZIP archive containing a forged size value, causing the server to allocate extremely large buffers during extraction.

Affected products

Orthanc Server/Orthanc
cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*
Range: <1.12.11

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

kb.cert.org/vuls/id/536588nvdThird Party AdvisoryVDB Entry
www.machinespirits.denvdNot Applicable
www.orthanc-server.comnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000