CISA Warns of Heap Out-of-Bounds Write Vulnerability in Medixant RadiAnt DICOM Viewer

On August 6, 2026, CISA released an advisory (ICSMA-26-218-01) regarding a vulnerability in Medixant RadiAnt DICOM, a widely used medical imaging viewer. The vulnerability, tracked as CVE-2026-17264, is a heap out-of-bounds write (CWE-787) that can be triggered when a user opens a crafted DICOM file containing malicious JPEG-compressed pixel data. Successful exploitation could cause the application to crash, and in a worst-case scenario, allow an attacker to execute arbitrary code on the affected system.

The affected product is Medixant RadiAnt DICOM versions 2025.2 and earlier. The product is deployed worldwide, particularly in the Healthcare and Public Health sector, and the vendor is headquartered in Poland.

CISA's advisory notes that the application is compiled with exploit mitigation mechanisms including Control Flow Guard (CFG), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR), which significantly reduce the practical exploitability of the issue. The CVSS scores are 4.3 (medium) under CVSS v3.1 and 5.3 (medium) under CVSS v4.0.

As of the advisory's publication, no known public exploitation specifically targeting this vulnerability has been reported to CISA. Exploitation requires user interaction, as an attacker would need to convince a user to open a malicious DICOM file.

The vendor has released version 2026.1 to remediate the vulnerability. Users are strongly advised to update to this version and to only open DICOM files from trusted and reliable sources. CISA also recommends minimizing network exposure for medical devices and following general security best practices to reduce the risk of exploitation.