DCMTK contains a heap over‑read (CWE-125) in the ConcatenationLoader component. The library copies pixel data frames without checking whether the PixelData buffer is large enough for the NumberOfFrames declared in the file. An attacker can craft a DICOM instance that declares more frames than the buffer contains, causing the application to read memory beyond the buffer and potentially crash or leak details of adjacent heap memory. Based on the description, the vulnerability can be triggered by supplying a malicious file to any program that uses DCMTK for DICOM processing.

Offis DCMTK versions through 3.7.0 are affected. The weakness resides in the ConcatenationLoader module. The vendor has acknowledged the issue in its issue tracker and a fix is present in later commits.

The CVSS score of 8.8 indicates a high severity risk. The EPSS score of 0.00347 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, relying on the ability to supply a crafted DICOM file to an application that processes such files, but the CVE data does not explicitly state the vector. If exploited, the attacker could cause a denial of service or obtain unintended memory contents.