This vulnerability involves a memory leak (CWE-401) in GDCM 3.2.2 triggered by processing malformed DICOM files with non-standard Value Representation (VR) types in the file meta information. The leak results in large heap allocations that are not freed, enabling an attacker to cause resource depletion and denial of service by supplying a crafted file. The CVSS 4.0 score is 8.7, reflecting network attack vector, no required privileges or user interaction, and high impact on availability.

Successful exploitation leads to denial-of-service conditions due to memory exhaustion on the system running the vulnerable GDCM library. This can disrupt services or applications relying on GDCM for DICOM file processing. There is no indication of confidentiality or integrity impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting or validating DICOM file inputs to avoid processing malformed files with non-standard VR types. Monitoring for abnormal memory usage during DICOM processing may help detect exploitation attempts.