This vulnerability involves a type confusion flaw in the OFFIS DICOM DCMTK Toolkit's worklist server component. An unauthenticated attacker can exploit this by sending a crafted query under specific conditions (valid Called AE Title, storage directory, lockfile, and matching worklist record) to cause a denial-of-service crash. The CVSS 4.0 base score is 8.7, indicating a high impact with network attack vector, no privileges or user interaction required, and high impact on availability.

Successful exploitation results in a denial-of-service condition by crashing the worklist server, potentially disrupting medical imaging workflows that rely on the DCMTK Toolkit. There is no indication of data confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor the vendor's communications for updates. Until a patch is available, restricting network access to the worklist server and employing network-level protections may reduce exposure.