This vulnerability (CWE-770) in Orthanc DICOM Server arises from the server's automatic extraction of ZIP archives and its trust in metadata fields that describe the uncompressed size of archived files. By crafting a small ZIP archive with a falsified large size value, an attacker can cause the server to allocate very large memory buffers during extraction, leading to memory exhaustion. The vulnerability affects Orthanc DICOM Server versions indicated as '0' (likely meaning initial or unspecified versions). No CVSS score or vendor patch information is currently available. The vendor advisory from CERT does not provide a remediation level or patch status.

An attacker can cause the Orthanc DICOM Server to consume excessive memory resources by uploading a specially crafted ZIP archive. This can lead to denial of service conditions due to memory exhaustion, potentially disrupting the availability of the DICOM server. There are no reports of active exploitation in the wild. The impact is limited to resource exhaustion without further details on code execution or data compromise.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until a fix is available, consider restricting or validating ZIP archive uploads to prevent processing of archives with forged metadata size fields. Monitor for updates from the Orthanc project or CERT advisory for official fixes or mitigations.