Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
Orthanc is a lightweight open-source DICOM server used in imaging workflows and research platforms, and embedded in some imaging products. CISA's advisory covers one vulnerability in versions below 1.13.0.
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-87020 | An integer overflow in a buffer-size calculation leads to a heap out-of-bounds write when Orthanc decodes an attacker-supplied PNG (CWE-190) | Tampering, Denial of service | Medium | High |
The published vector is network-reachable with no user action, but it requires a low-privilege account. That's why Exploitability reads Medium rather than High: one of the three conditions for High isn't met. Integrity and availability impacts are High. On Blue Goat's security matrix, that's High as published.
The published vectors describe the software, not your device. If the service is reachable only on a segmented clinical network or behind authentication, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.
| Severity from your hazard analysis | Safety risk at Medium exploitability |
|---|---|
| Negligible | Low |
| Minor or Serious | Medium |
| Critical or Catastrophic | High |
A heap out-of-bounds write can crash the server, which stops image storage and retrieval. Depending on how it's exploited, it may also corrupt memory the service relies on.
What to check now
- Search your SBOM for Orthanc below 1.13.0.
- Check who holds accounts that can upload images, since the attack needs a low-privilege login.
- Update to 1.13.0, which Orthanc recommends.
- If you're not affected, record that in a VEX statement with the justification.
- Re-score the threat, and carry any patient-harm result into your ISO 14971 file.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.