This vulnerability in Orthanc DICOM Server involves improper handling of dimension fields in DICOM images. The decoder expects dimensions encoded as VR Unsigned Short but instead processes VR Unsigned Long values, which can be very large. This causes an integer overflow during the calculation of frame size, resulting in a heap buffer overflow due to out-of-bounds memory access during image decoding. The issue is classified under CWE-190 (Integer Overflow or Wraparound). There is no CVSS score or vendor-provided patch information available at this time. The vendor advisory from CERT is referenced but does not specify remediation details.

The integer overflow and subsequent heap buffer overflow could potentially lead to memory corruption during image decoding. This may allow an attacker to cause application crashes or potentially execute arbitrary code if exploited. However, no known exploits are currently reported in the wild, and the exact impact depends on the attacker's ability to supply maliciously crafted DICOM images to the vulnerable server.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is available, users should consider restricting access to the DICOM server and carefully validate or sanitize incoming DICOM images to prevent processing of maliciously crafted files that exploit this vulnerability.