--- a/NEWS	Wed Mar 04 12:22:47 2026 +0100
+++ b/NEWS	Mon Mar 16 15:09:06 2026 +0100
@@ -147,6 +147,7 @@
   - Fix possible out-of-bound access when rows/columns DICOM tags exceed the maximum value for a US (65535).
   - Fix possible out-of-bound access in PMSCT_RLE1 encoded images.
   - Fix possible out-of-bound access in palette images.
+  - Fix possible out-of-bound access when reading a DICOM file with invalid group length tag.
 * Upgraded dependencies for static builds:
   - civetweb 1.16, including patch for CVE-2025-55763
   - SQLite 3.50.4

--- a/OrthancFramework/Sources/DicomFormat/DicomStreamReader.cpp	Wed Mar 04 12:22:47 2026 +0100
+++ b/OrthancFramework/Sources/DicomFormat/DicomStreamReader.cpp	Mon Mar 16 15:09:06 2026 +0100
@@ -204,6 +204,11 @@
       {
         uint16_t length = ReadUnsignedInteger16(p + pos + 6, true);
 
+        if (pos + 8 + length > block.size())
+        {
+          throw OrthancException(ErrorCode_BadFileFormat, "DICOM meta-header tag length exceeds available data");
+        }
+
         std::string value;
         value.assign(p + pos + 8, length);
         NormalizeValue(value, vr);
@@ -237,6 +242,11 @@
           
         uint32_t length = ReadUnsignedInteger32(p + pos + 8, true);
 
+        if (pos + 12 + static_cast<size_t>(length) > block.size())
+        {
+          throw OrthancException(ErrorCode_BadFileFormat, "DICOM meta-header tag length exceeds available data");
+        }
+
         if (tag.GetGroup() == 0x0002)
         {
           std::string value;