This vulnerability (CWE-401) involves missing release of memory after its effective lifetime in the OFFIS DICOM DCMTK Toolkit's storescp component. An unauthenticated attacker can exploit this by sending repeated crafted connection requests, causing a memory leak that leads to resource exhaustion and service denial. The issue affects the storescp service running in single-process mode, resulting in the service termination and requiring operator intervention to restore functionality.

Successful exploitation results in a denial of service condition where the storescp service consumes increasing memory until it is killed by the system. This disrupts the availability of the service, which remains down until an operator restarts it. There is no indication of data compromise or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, operators should monitor the storescp service for abnormal memory growth and be prepared to restart the service if it becomes unresponsive. Consider running storescp in a multi-process mode if supported, as the vulnerability specifically affects the default single-process mode.