As reported by CISA in advisory ICSMA-26-218-01, a newly disclosed vulnerability in Medixant's RadiAnt DICOM viewer exposes healthcare organizations worldwide to potential remote code execution through maliciously crafted medical imaging files. While the CVSS v3 score of 4.3 may appear modest at first glance, the underlying technical reality — a heap out-of-bounds write triggered by attacker-controlled JPEG-compressed pixel data — carries significantly higher practical risk than that score communicates.
Vulnerability Details
- CVE ID
- CVE-2026-17264
- CVSS v3 Score
- 4.3 (Medium — vendor-assigned; real-world RCE potential warrants elevated concern)
- Affected Product
- Medixant RadiAnt DICOM Viewer, all versions ≤ 2025.2
- Vendor
- Medixant (Poland)
- Vulnerability Type
- Out-of-bounds Write (CWE-787) via heap corruption in JPEG-compressed DICOM pixel data parsing
- Exploit Requirement
- User must open a crafted DICOM file; no authentication required beyond file delivery
- Active Exploitation
- Not currently observed in the wild (as of advisory date)
- Patch Available
- Yes — update to RadiAnt DICOM version 2026.1
- Sectors Affected
- Healthcare and Public Health — deployed worldwide
Why the CVSS Score Understates the Risk
The 4.3 CVSS score assigned here reflects a vendor-scoped assessment that likely weights user interaction and local context heavily. However, cybersecurity practitioners in clinical environments know that DICOM files are routinely exchanged between systems, forwarded via email, uploaded to PACS integrations, and even shared externally with referring physicians. A threat actor who can place a weaponized DICOM file in front of a radiologist or imaging technician — whether through a phishing attachment, a compromised file-sharing portal, or a rogue DICOM send — has a realistic path to code execution on a clinical workstation.
Heap out-of-bounds writes are among the most exploitable memory corruption classes. When triggered by attacker-controlled data (in this case, malformed JPEG pixel streams embedded in a DICOM container), they become powerful primitives for sandbox escape, privilege escalation, and lateral movement within hospital networks — environments notorious for flat network architectures and legacy systems.
The DICOM Threat Surface Is Frequently Overlooked
DICOM viewers occupy a peculiar blind spot in many healthcare security programs. They are clinical tools, not IT infrastructure, and often fall outside standard patch management cycles. In many radiology departments, workstations running imaging software are treated as appliances — updated only during vendor maintenance windows, if at all. This creates extended exposure windows that sophisticated threat actors, including ransomware groups targeting healthcare, actively exploit.
RadiAnt is a widely used, lightweight DICOM viewer with a significant installed base in smaller clinics, imaging centers, and teleradiology workflows — precisely the environments with the least mature patch management discipline.
Shield53 Recommendations
Immediate Actions
Longer-Term Posture
- Include medical imaging software in your formal vulnerability management program — not just IT assets.
- Engage clinical engineering and radiology IT teams in patch coordination; security teams rarely have direct visibility into imaging workstation fleets.
- Evaluate network segmentation between clinical imaging workstations and broader hospital networks to limit lateral movement potential.
- Review vendor security advisories from CISA's ICS-CERT medical advisory feed as a standing intelligence source for healthcare-specific vulnerabilities.
The healthcare sector remains one of the most aggressively targeted verticals by ransomware operators and nation-state actors alike. Vulnerabilities in clinical software — even those scored as "medium" — deserve the same urgency as critical infrastructure CVEs when patient safety and care continuity are on the line.
