CISA flags RadiAnt DICOM flaw that could crash app and allow code execution
CISA issued an advisory on a medium-severity flaw in Medixant RadiAnt DICOM and urged users to update to version 2026.1 and open files only from trusted sources.
CISA on Aug. 6 issued an advisory on a medium-severity flaw in Medixant’s RadiAnt DICOM viewer that could crash the application and, in some cases, allow remote code execution if a malicious DICOM file is opened.
CISA said the issue affects RadiAnt DICOM versions 2025.2 and earlier and noted that the product is used in the healthcare and public health sector and deployed worldwide.
CISA identified the flaw as CVE-2026-17264 and described it as an out-of-bounds write. The agency said successful exploitation could cause the application to crash when a maliciously crafted DICOM file is opened. It added that opening a crafted file containing malicious JPEG-compressed pixel data can trigger an attacker-controlled heap out-of-bounds write, which may allow arbitrary code execution.
The advisory gives the flaw a CVSS v3.1 base score of 4.3 and a CVSS v4.0 base score of 5.3, both rated medium. CISA said the application includes exploit mitigations such as Control Flow Guard, Data Execution Prevention and Address Space Layout Randomization, which it said significantly reduce the practical exploitability of the issue.
CISA said the vulnerability was reported to the agency by banda, oriotie, ax123, jihyeon4725, lacroix and minzu. The agency also said no known public exploitation specifically targeting the flaw had been reported to CISA at the time of publication.
CISA recommended updating to version 2026.1. It also advised users to open DICOM files only from trusted and reliable sources. The advisory links to the RadiAnt 2026.1 installer.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()