CVE-2026-17264 Medixant CVE debrief

Who should care

Defenders responsible for medical imaging systems, especially those using Radiantviewer software, should assess exposure and verify configurations. This includes reviewing and updating configurations for systems handling DICOM files to prevent potential attacks. The vulnerability's impact is heightened in environments where medical imaging systems are not regularly updated or patched, making it critical to review and update configurations. Security teams,

Why it matters

CVE-2026-17264 is a medium-severity vulnerability in a DICOM file parsing library. Opening a crafted DICOM file can trigger a heap out-of-bounds write, potentially allowing remote code execution. Defenders responsible for medical imaging systems, especially those using Radiantviewer software, should assess exposure and verify configurations.

• Potential remote code execution requires immediate assessment and verification of exposure
• Defenders must review and update configurations for systems handling DICOM files
• Remediation priority is uncertain due to limited information on affected versions

Technical summary

The vulnerability is triggered by opening a crafted DICOM file containing malicious JPEG-compressed pixel data, which causes a heap out-of-bounds write. This may allow an attacker to remotely execute arbitrary code. The vulnerability affects a DICOM file parsing library used in medical imaging systems, emphasizing the need for defenders to review and update configurations for systems handling DICOM files, especially in contexts using Radiantviewer software. Limited information on affected versions makes it crucial to assess exposure and verify configurations.

Defensive priority

Assess exposure of systems handling DICOM files, especially in medical imaging contexts. Verify if Radiantviewer software is in use and review its configuration.

Recommended defensive actions

• Assess exposure of systems handling DICOM files
• Verify if Radiantviewer software is in use and review its configuration
• Monitor for updates from the vendor on remediation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The ICS-CERT references provide additional context but do not offer specific details on affected versions or remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.