This vulnerability involves an integer overflow (CWE-190) in the Orthanc DICOM Server when parsing PAM images within DICOM files. Specifically, the image dimensions are multiplied using 32-bit unsigned arithmetic, which can overflow and cause the server to allocate a buffer smaller than required. Subsequent pixel processing writes beyond the allocated buffer, causing a heap buffer overflow. The CVSS v3.1 base score is 7.1, reflecting local attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

Successful exploitation can lead to heap buffer overflow, potentially allowing an attacker to alter the integrity of the server or cause denial of service by crashing the application. Confidentiality is not impacted according to the CVSS vector. The attack requires local access and user interaction, limiting remote exploitation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is available, avoid processing untrusted or specially crafted PAM images embedded in DICOM files. Monitor the vendor advisory for updates on patches or mitigations.