This vulnerability involves an integer overflow (CWE-190) during the decoding process of PALETTE COLOR DICOM images in the Orthanc DICOM Server. The multiplication of width and height values for pixel length validation uses 32-bit arithmetic, which can overflow and bypass validation checks. This leads to a heap buffer overflow, enabling out-of-bounds memory access during image decoding. The issue affects version 0 of the product, with no patch or official remediation level published yet. The vendor advisory from CERT is available but does not specify a fix or mitigation.

Successful exploitation could result in a heap buffer overflow, potentially allowing an attacker to cause a denial of service or execute arbitrary code within the context of the Orthanc DICOM Server process. However, no known exploits have been reported, and the exact impact depends on exploitation feasibility and environment.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is released, cautious handling of untrusted PALETTE COLOR DICOM images is advised. No vendor-provided mitigation or temporary fix is currently documented.