Orthanc’s DICOM server can overflow a heap buffer when it processes a carefully crafted PAM image embedded in a DICOM file. The server multiplies the image’s width and height using 32‑bit unsigned arithmetic; if these values are chosen to trigger an integer overflow, the computed buffer size becomes smaller than the actual number of pixels that will be written. The write operation then exceeds the allocated memory, corrupting heap data and potentially leading to unpredictable execution, denial of service, or arbitrary code execution.

The vulnerability affects the Orthanc DICOM Server, specifically any release that supports PAM image parsing. No particular version range is provided, so all installations with PAM handling should be considered vulnerable until a patch is applied.

The flaw carries a CVSS score of 7.1, indicating high severity. The estimated EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Orthanc normally receives DICOM files over a network connection, so a remote attacker who can supply a malicious file could trigger the overflow. Because the overflow can corrupt memory and may allow arbitrary code execution, the potential impact is significant, even if the chance of exploitation remains modest at present.