CISA Warns of Remote Code Execution Vulnerability in Medixant RadiAnt DICOM Software
CISA has issued an advisory for a critical vulnerability in Medixant RadiAnt DICOM software that could allow remote code execution if users open a specially crafted DICOM file.
The Cybersecurity and Infrastructure Security Agency (CISA) has alerted users to a significant vulnerability, identified as CVE-2026-17264, affecting Medixant RadiAnt DICOM software versions prior to 2026.1. Successful exploitation of this flaw could enable an attacker to remotely execute arbitrary code on a victim's system.
The vulnerability stems from an out-of-bounds write condition that occurs when the application processes a maliciously crafted DICOM file. Specifically, if the file contains malicious JPEG-compressed pixel data, it can trigger an attacker-controlled heap out-of-bounds write. This type of vulnerability is often a gateway for attackers to gain control over the affected system.
While the primary concern is remote code execution, CISA also notes that exploitation could lead to an application crash if a crafted DICOM file is opened. The affected versions include all releases of Medixant RadiAnt DICOM up to and including version 2025.2. The software is deployed globally within the Healthcare and Public Health critical infrastructure sector.
Medixant has released version 2026.1 of RadiAnt DICOM as a remediation. Users are strongly advised to update to this latest version as soon as possible. In addition to patching, CISA recommends that users exercise caution and only open DICOM files from trusted and reliable sources to further mitigate the risk of exploitation.
Exploit mitigation mechanisms are reportedly enabled in the application, including Control Flow Guard (CFG), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR). These built-in security features are designed to make practical exploitation more difficult, even if the vulnerability exists.
CISA has assigned a CVSS v3.1 base score of 4.3 (MEDIUM) and a CVSS v4.0 base score of 5.3 (MEDIUM) to this vulnerability. The CVSS vectors indicate that while the attack vector is network-based and requires user interaction (opening a file), it does not require any privileges and has a low impact on confidentiality and integrity, but a low impact on availability (application crash).
At the time of the advisory's publication, CISA reported no known public exploitation specifically targeting this vulnerability. However, the presence of a public proof-of-concept or active exploitation could significantly increase the risk to organizations using the affected software.
CISA encourages organizations to implement defensive measures, such as minimizing network exposure of control system devices, isolating them behind firewalls, and using secure remote access methods like VPNs. They also remind users to perform thorough impact and risk assessments before deploying any security measures.