An out-of-bounds read occurs in the DecodeLookupTable routine of the DicomImageDecoder when handling PALETTE COLOR images. The validator does not check whether pixel indices are within the bounds of the lookup table, allowing a malicious image file with indices larger than the palette to force the decoder to read beyond the allocated buffer and expose arbitrary heap contents in the decoded image. This results in information disclosure, enabling an attacker to access sensitive data that may reside in the server’s memory at the time of decoding.

The Orthanc DICOM Server product is affected. No specific version numbers are provided, so all releases that include the vulnerable DicomImageDecoder implementation could be impacted.

The exploitation leads to moderate‑to‑high information disclosure. The vulnerability does not provide code execution or denial of service. An attacker would need to craft a PALETTE COLOR image and deliver it to Orthanc, for example, via the web interface or API. EPSS data is not available and the CVE is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is uncertain, but the impact remains significant.