An out-of-bounds read occurs in the DecodePsmctRle1 routine of Orthanc’s DICOM image decoder. This is a CWE-125 vulnerability. The routine, used for Philips proprietary RLE1 compression, fails to validate escape markers near the stream’s end, allowing a specially crafted sequence to cause the decoder to read beyond its allocated buffer. This read can leak adjacent heap memory into the rendered image, exposing potentially sensitive data that resides near the buffer.

Orthanc’s DICOM Server software is affected. All builds that include the DecodePsmctRle1 routine are vulnerable, and the CVE entry does not restrict the version window, implying that current releases with PMSCT_RLE1 support are at risk.

The flaw carries a CVSS score of 7.1, indicating moderate to high severity, while its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting low exploitation likelihood at this time. The likely attack vector is inferred to be the network interface that accepts DICOM uploads; an attacker would need to supply a malicious DICOM file containing a crafted PMSCT_RLE1 payload. If processed, the attacker could read memory contents and potentially obtain confidential information.