The vulnerability is a heap‑based buffer overflow in the vtk-dicom library, triggered when the function vtkDICOMItem::NewDataElement processes a DICOM data element that is larger than the buffer allocated for it. The overflow can corrupt memory and allows an attacker to execute arbitrary code in the context of the running process. This flaw is classified as CWE‑129 and can lead to full privilege escalation if the process has elevated rights.

The affected product is vtk‑dicom from the VTK project. No specific product version numbers are listed in the CNA data. The vulnerability applies to any build of vtk‑dicom that contains the unpatched vtkDICOMItem::NewDataElement routine.

The CVSS score of 8.1 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. However, the data overflow could be exploited by an attacker who can supply crafted DICOM data to a running vtk‑dicom instance, making the attack vector likely network‑based. The absence of a listed KEV entry does not diminish the risk; during a security assessment the outlook is that knowledgeable adversaries could leverage this flaw to take control of the affected system.