An out-of-bounds read occurs while parsing DICOM meta-headers in the DicomStreamReader component. The reader may access memory beyond the allocated buffer when it encounters malformed metadata structures. This defect does not necessarily crash the server or expose sensitive data directly, but it indicates insufficient input validation and could potentially lead to memory disclosure or unexpected behavior if the attacker can read corrupted data.

The vulnerability affects the Orthanc DICOM Server. The vendor product is listed as Orthanc:DICOM Server. Specific affected versions are not disclosed in the provided information; therefore, any deployment of Orthanc that includes the DicomStreamReader module may be susceptible. No further version granularity is given.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote, where an attacker sends a crafted DICOM file over the network to trigger the out-of-bounds read during parsing. Since the flaw results in a memory read beyond bounds, the exploitation conditions required are the delivery of malformed DICOM metadata, which a remote attacker could achieve.