Medixant RadiAnt DICOM Viewer Heap Out-of-Bounds Write (CVE-2026-17264)
First seen Aug 7, 2026 · Updated Aug 7, 2026 · CVSS 4.3
A heap out-of-bounds write vulnerability (CVE-2026-17264) affects Medixant RadiAnt DICOM Viewer versions 2025.2 and earlier, triggered by opening a maliciously crafted DICOM file with malformed JPEG-compressed pixel data. Successful exploitation could crash the application or potentially allow remote code execution, though built-in exploit mitigations (CFG, DEP, ASLR) reduce practical exploitability. No known public exploitation has been reported to date.
Technical Analysis
CVE-2026-17264 is a CWE-787 heap-based out-of-bounds write in Medixant RadiAnt DICOM Viewer (<=2025.2), triggered when the application parses a crafted DICOM file containing malicious JPEG-compressed pixel data, resulting in attacker-controlled heap corruption. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) reflects a network attack vector requiring user interaction, with the vendor noting that CFG, DEP, and ASLR mitigations reduce real-world exploitability despite CISA describing potential remote code execution. This is a client-side file-parsing vulnerability requiring social engineering (e.g., delivering a malicious .dcm file) rather than a direct network-exploitable service flaw. There is no plausible direct impact to AI agent systems, as this is a standalone medical imaging desktop application with no reported agent, API, or automation integration relevant to LLM/RAG pipelines.
Affected Systems
Medixant RadiAnt DICOM Viewer version 2025.2 and earlier, running on Windows systems in healthcare imaging environments worldwide
Indicators of Compromise
- No known IOCs published; vulnerability trigger is a maliciously crafted DICOM file (.dcm) with malformed JPEG-compressed pixel data
Remediation Steps
- 1
Update RadiAnt DICOM Viewer
Upgrade to version 2026.1 or later, available at https://www.radiantviewer.com/files/RadiAnt-2026.1-Setup.exe
- 2
Restrict DICOM file sources
Only open DICOM files received from trusted and verified sources; avoid opening files from unsolicited emails or unknown origins
- 3
Network segmentation
Isolate control system and imaging workstation networks from business networks and the internet, using firewalls where applicable
- 4
Secure remote access
Use VPNs with up-to-date patching for any required remote access to systems running RadiAnt DICOM Viewer
- 5
User awareness training
Educate staff on phishing and social engineering risks associated with malicious file attachments, per CISA recommended practices
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.