DCMTK

In the function deleteOldestImages() , an array named StudyArray is allocated on the heap with a fixed size of MAX_NUMBER_OF_IMAGES (defined as 10000 in dcmqridx.h ).
The code then enters an unbounded loop to populate this array by iterating through the index database. There is no bounds check on the counter ( nbimages ) before writing to the array.
If a study contains more than 10000 images and the storage quota ( maxBytesPerStudy , defined in dcmqrscp's configuration file) is exceeded, the function writes past the end of the StudyArray buffer, leading to a buffer overflow on the heap.

Reported 2026-03-29 by DCMTK user 'elp3pinill0'.