A heap buffer overflow occurs when the DICOM image decoder processes dimension fields encoded as Unsigned Long instead of the expected Unsigned Short. The mismatch leads to an integer overflow during frame size calculation, causing an out-of-bounds write on the heap while decoding an image. This weakness is a classic heap buffer overflow and potentially allows an attacker to corrupt memory or crash the application.

Orthanc DICOM Server is impacted. The advisory does not list a specific version range, implying that all releases that have not yet applied a patch are vulnerable. Operators should verify the version of Orthanc they are running and check the Orthanc website or related advisories for the latest fix.

Quantitative risk metrics are not supplied; no CVSS or EPSS score is available. The vulnerability is not present in the CISA KEV catalog, indicating no documented large-scale exploitation. Based on the description, the likely attack vector is remote if the server accepts DICOM files from outside the local network; local access also suffices. Exploitation requires delivery of a crafted DICOM file that triggers the overflow. No public exploit is known, but the crash or memory corruption represents a denial‑of‑service risk and could facilitate further compromise if the corrupted memory is leveraged by an attacker.