RadiAnt DICOM Heap Bug Opens Door to Remote Code Execution
The CVSS vectors flag a medium-severity crash, but the advisory warns of arbitrary code execution, and hospital PACS workflows ingest DICOM files from every external imaging source without pre-screening them.
TL;DR
CISA released ICSMA-26-218-01 for CVE-2026-17264, a heap out-of-bounds write in Medixant RadiAnt DICOM Viewer through version 2025.2. A crafted DICOM file with malicious JPEG-compressed pixel data triggers an attacker-controlled write that can enable remote code execution. The fix is version 2026.1. The CVSS scores, 4.3 in v3.1, 5.3 in v4.0, register only availability impact, but the advisory's own risk evaluation describes RCE. In hospital PACS environments, DICOM files arrive continuously from referring physicians, teleradiology services, and patient portals; user interaction isn't a security barrier when double-clicking imaging files is the workflow.
The vulnerability
CVE-2026-17264 is a heap out-of-bounds write (CWE-787) triggered when RadiAnt DICOM parses JPEG-compressed pixel data inside a DICOM file. The attacker crafts the file, the user opens it, and the write lands where it shouldn't, with the advisory warning this "may allow an attacker to remotely execute arbitrary code." Six researchers reported it to CISA. Medixant's 2026.1 release patches the bug. The application ships with Control Flow Guard, Data Execution Prevention, and Address Space Layout Randomization enabled; the advisory notes these compile-time mitigations "significantly reduce the practical exploitability."
The score doesn't match the text
That's the tension. The CVSS v3.1 score is 4.3, v4.0 is 5.3, both Medium, both reflecting only availability impact. The scoring effectively treats this as a crash bug, not an RCE bug. The reasoning makes sense on paper: those exploit mitigations raise the bar, so the practical risk looks lower. But the advisory's own risk evaluation still says arbitrary code execution is possible, and in a hospital PACS deployment the attack surface doesn't care about CVSS nuance. DICOM files pour in from referring physicians, teleradiology services, patient portals, and CD imports. A radiologist opening files isn't being phished, they're doing their job. The "user interaction required" flag in the CVSS vector doesn't capture how routinely and unavoidably that interaction occurs in clinical imaging.
A familiar pattern
This is RadiAnt's second CISA advisory. The first, ICSMA-25-051-01 from February 2025, covered CVE-2025-1001, an improper certificate validation in the update mechanism that could allow a machine-in-the-middle attack delivering malicious updates. And it's part of a broader run of heap out-of-bounds write vulnerabilities in DICOM viewers: Santesoft DICOM Viewer Pro (CVE-2025-2480, March 2025) and MicroDicom DICOM Viewer (CVE-2025-5943, June 2025) both had the same weakness class at higher CVSS scores. DICOM parsing keeps producing the same bug across vendors. The fix for RadiAnt users is straightforward, update to 2026.1 or restrict DICOM file sources to trusted origins, but the structural problem, where medical imaging software sits on hospital networks parsing untrusted files from outside, doesn't go away with a single patch.
Published ·Deep Fathom