The vulnerability in DCMTK (versions up to 3.7.0) involves improper validation in the ConcatenationLoader when handling pixel data frames. Specifically, the code copies pixel data frames based on a declared NumberOfFrames without verifying that the PixelData buffer is sufficiently large. An attacker can exploit this by crafting DICOM instances that declare more frames than the actual buffer contains, leading to heap over-read conditions. This can result in application crashes or memory disclosure.

Exploitation of this vulnerability can cause denial of service via application crashes or potentially leak sensitive information from adjacent heap memory. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 score is 8.8 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on availability and moderate impact on confidentiality.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when processing untrusted DICOM files and consider additional validation or sandboxing measures.