The OFFIS DCMTK Toolkit contains a flaw that prevents allocated memory from being released after its intended lifetime, enabling a remote attacker to craft successive connection requests that leak memory. The aggregation of leaked memory eventually exhausts the system’s memory pool, causing the service to crash and the port to become unresponsive until the service is restarted. This issue is a high‑severity vulnerability that disrupts availability, as indicated by the CVSS score provided.

All installations of the OFFIS DICOM:DCMTK Toolkit are affected, regardless of the deployment model. The flaw becomes critical in single‑process deployments where the memory pool is shared across all connections; no specific product version is listed, so any released build before the publisher’s latest commit is considered vulnerable.

The vulnerability is exploitable by an unauthenticated remote attacker who can initiate connection sequences without authentication, implying that network exposure to the DCMTK service provides the attack vector. The high CVSS score of 8.7 underscores significant risk, while the lack of an EPSS value does not diminish the likelihood of exploitation in environments with exposed service ports. The vulnerability is not yet included in the CISA KEV catalog. If an attacker succeeds, the denial of service can go on until a system administrator restarts the service, after which a new memory leak cycle can begin.