out-of-bounds-write 1 DICOM, Pydicom, GDCM, and Orthanc: A technical tour of what really happens in the heap May 28, 2026