A significant security vulnerability has been identified within the Medixant RadiAnt DICOM software, prompting an urgent advisory for healthcare organizations globally. According to CISA Advisories, versions of the application up to and including 2025.2 are affected by a heap out-of-bounds write defect, identified as CVE-2026-17264, which stems from how the software processes maliciously crafted JPEG-compressed pixel data within DICOM files.
Successful exploitation of this vulnerability could lead to an application crash or, more critically, allow an attacker to remotely execute arbitrary code on the host system. The vulnerability is categorized under CWE-787: Out-of-bounds Write. The risk profile is underscored by a CVSS 3.1 base score of 4.3 and a CVSS 4.0 base score of 5.3, both of which are classified as medium severity. The vulnerability was reported to authorities by security researchers banda, oriotie, ax123, jihyeon4725, lacroix, and minzu.
Technical Vulnerability Metrics
| Metric | Value |
|---|---|
| CVE ID | CVE-2026-17264 |
| CVSS 3.1 Base Score | 4.3 |
| CVSS 4.0 Base Score | 5.3 |
| Impacted Versions | <=2025.2 |
| Required Remediation | Upgrade to 2026.1 |
Medixant has provided a patch via version 2026.1 to address the flaw. To mitigate potential exploitation, users are advised to update their software immediately. Furthermore, administrators should strictly limit the opening of DICOM files to those originating from trusted sources. While the application architecture incorporates defensive mechanisms such as Control Flow Guard (CFG), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR)—which serve to impede successful exploitation—security experts emphasize that these layers do not replace the need for an official software update.
Why It Matters
Medical imaging infrastructure is a frequent target for malicious actors due to the sensitive nature of patient data and the potential for operational disruption. This vulnerability highlights the persistent risk that proprietary medical software presents to hospital networks. Because healthcare providers often operate legacy systems that are slow to patch, a flaw in a widely used viewer like RadiAnt can create a massive attack surface. Organizations must view this update not as an optional maintenance task, but as a core component of maintaining the clinical integrity and cybersecurity hygiene of their diagnostic environments.
Reader Discussion & Insights