An integer overflow vulnerability in the Orthanc DICOM Server, affecting versions prior to 1.13.0, enables remote memory corruption that could lead to system instability or unauthorized code execution.

This vulnerability is caused by an integer overflow during pitch and buffer-size computation, which triggers a heap out-of-bounds write when the software processes a crafted PNG image. An authenticated attacker can exploit this condition to impact the integrity and availability of the server.

Successful exploitation of this flaw allows an attacker to cause memory corruption, potentially leading to service crashes or other unauthorized impacts on the server. With a CVSS score of 8.1, this represents a high-severity risk that could disrupt critical clinical workflows dependent on DICOM image processing.

Immediate Action: Update the Orthanc DICOM Server software to version 1.13.0 or later as recommended by the vendor.

Proactive Monitoring: Monitor server logs for unexpected service crashes or errors related to image processing tasks that might indicate exploitation attempts.

Compensating Controls: Restrict access to the DICOM server interface to trusted administrative accounts to reduce the attack surface, as the vulnerability requires authenticated access.

Public Exploit Available: No — exploit_available (unknown).

Given the high CVSS severity and the potential for service disruption in a medical imaging environment, immediate patching is required. Organizations should prioritize updating all instances of the Orthanc DICOM Server to version 1.13.0 to eliminate the risk of heap-based memory corruption.