MP4Parser fails to validate MP4 box sizes, allowing a maliciously crafted box to cause the parser to make no forward progress and repeatedly process the same data. This results in an infinite loop that consumes CPU and memory, leading to service degradation or crash. The weakness corresponds to CWE-835, Design Flaw, Denial of Service.

The vulnerability affects the J4Care dcm4chee-arc-light product. No specific version ranges are listed, but the vendor indicates that all current releases prior to the 5.35.2 fix are vulnerable and should be updated to 5.35.2 or newer.

The CVSS score of 8.7 classifies this flaw as High severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote, with an attacker able to supply a malformed MP4 file to a service that invokes MP4Parser, triggering the denial of service condition. Exploitation requires driver over interacting with the MP4Parser component and can manifest as excessive CPU or memory consumption, potentially disrupting normal operations.