JPEGParser can enter an infinite loop when parsing a specially crafted or truncated JPEG stream, which exhausts CPU resources and eventually renders the dcm4chee-arc-light service unresponsive. This flaw represents an unreachable exit condition classified as CWE‑835 and can lead to denial of service.

The vulnerability affects the J4Care dcm4chee-arc-light application, specifically versions prior to release 5.35.2. Users running those earlier versions should verify their installed product version and plan an upgrade to the recommended 5.35.2 or later release.

The CVSS score of 8.7 indicates high severity; EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exercise the loop by delivering a malformed JPEG stream to the parser over the network, potentially impacting availability of the medical imaging service for legitimate users. The exploitation requires remote network access to the affected component and sufficient processing capacity to sustain the infinite loop.