An out-of-bounds read vulnerability (CWE-125) exists in the Orthanc DICOM Server's DicomStreamReader during the parsing of DICOM meta-headers. When processing malformed metadata, the parser may read beyond the allocated metadata buffer, reflecting inadequate input validation. Although this does not usually cause server crashes or data leaks, it poses a risk of denial of service due to potential application instability. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5 (Network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact). There is no vendor-provided patch or official remediation guidance available at this time.

The vulnerability can lead to an out-of-bounds read during DICOM meta-header parsing, which may cause application instability or denial of service (availability impact). There is no direct impact on confidentiality or integrity, and no evidence of data exposure or remote code execution. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is available, cautious handling of untrusted DICOM metadata and limiting exposure of the vulnerable service to untrusted networks may reduce risk. No vendor advisory indicates that the issue is already mitigated or that no action is required.