This vulnerability involves an out-of-bounds read in the DecodePsmctRle1 function within DicomImageDecoder.cpp of the Orthanc DICOM Server. The PMSCT_RLE1 decompression routine fails to properly validate escape markers placed near the end of the compressed data stream, allowing a crafted sequence to cause memory reads beyond the allocated buffer. This can result in leakage of heap memory data into the output image. The issue is tracked as CWE-125 and was published on 2026-04-09. No official remediation or patch has been documented, and no CVSS score is assigned.

The vulnerability may lead to unintended disclosure of heap memory contents through the rendered image output. This could expose sensitive data residing in memory at the time of decompression. There is no indication of remote code execution or system compromise from the provided data. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is available, users should exercise caution when processing untrusted or specially crafted Philips Compression format images. No vendor advisory indicates that the issue is already mitigated or that no action is required.