During the decoding of PALETTE COLOR DICOM images, the Orthanc DICOM Server performs pixel length validation using 32‑bit multiplication for width and height. If the resulting product overflows, the check incorrectly succeeds, allowing the decoder to read and write beyond allocated buffers. This heap buffer overflow can corrupt memory and potentially enable arbitrary code execution or denial of service.

The vulnerability affects the Orthanc DICOM Server. No specific product versions are listed in the available information; administrators should verify whether their deployment uses versions susceptible to the described issue.

Because the flaw is a classic heap buffer overflow, it presents a high risk of exploitation, especially if attackers can supply crafted DICOM files to the server. The CVSS score is not provided, and EPSS data is unavailable, but the nature of the vulnerability suggests that exploitation is feasible with minimal prerequisites. The vulnerability is not yet listed in the CISA KEV catalog, but that does not diminish its potential impact. Attacks would likely occur remotely via the network path that delivers DICOM images to the server.