[Debian-med-packaging] Bug#1138713: Bug#1138713: Bug#1138713: orthanc: CVE-2026-10528

[Sébastien Jodogne]

Hello,

>>> The "dcmtk" package must be fixed by introducing the following upstream patch:
>>> https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f
> [...]
> I believe the appropriate course of action is to wait for dcmtk
> 3.7.1 and properly transition once it is out.  In the meantime,
> I am preparing a dcmtk upload to unstable reverting that patch.

As a quick followup, Orthanc 1.13.0 is now released. Static builds of 
Orthanc bundle the fix for CVE-2026-10528 [1].

The orthanc Debian package has been updated for this new upstream 
release and "orthanc/1.13.0+dfsg-1" is currently waiting for a sponsored 
upload [2].

However, even after "orthanc/1.13.0+dfsg-1" is uploaded, CVE-2026-10528 
will not be fixed until the dcmtk package is updated with the patch 
referenced in the previous messages in this thread, as the orthanc 
package dynamically links against dcmtk.

Regards,
Sébastien-

[1] https://orthanc.uclouvain.be/hg/orthanc/file/Orthanc-1.13.0/NEWS
[2] https://lists.debian.org/debian-med/2026/08/msg00023.html