EUVD-2026-54310
GHSA-4r83-wp58-872p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File-based delivery is network-reachable (AV:N); no privileges required (PR:N); user must open file (UI:R); heap OOB write with RCE yields full C/I/A impact.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
AnalysisAI
Heap out-of-bounds write in RadiAnt DICOM Viewer is triggered when processing JPEG-compressed pixel data embedded in a crafted DICOM file, potentially enabling arbitrary code execution on the victim's workstation. Reported to CISA ICS-CERT as a medical device advisory (ICSMA-26-218-01), the vulnerability requires no privileges and only passive user interaction - consistent with file-preview or file-open workflows common in clinical imaging environments. The provided CVSS 4.0 score of 5.3 rates impact as availability-only (VA:L), which conflicts materially with the described RCE potential; this discrepancy is significant and should be independently verified. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Technical ContextAI
The vulnerability resides in the JPEG-compressed pixel data parser within RadiAnt DICOM Viewer, a Windows-based medical imaging application for viewing DICOM files generated by radiology equipment (CT, MRI, PET scanners). DICOM (Digital Imaging and Communications in Medicine) supports multiple transfer syntaxes, including JPEG-compressed pixel data (e.g., JPEG Baseline, JPEG Lossless), which requires an embedded image decoder. CWE-787 (Out-of-bounds Write) identifies the root cause: attacker-controlled data allows writing beyond an allocated heap buffer during JPEG decoding, a memory corruption class that historically enables reliable code execution when the write primitive is sufficiently controlled. The CISA advisory (ICSMA-26-218-01) classifies this under ICS Medical, indicating the affected deployment context is clinical or healthcare infrastructure.
RemediationAI
The primary remediation is to update RadiAnt DICOM Viewer to version 2026.1 or later, available via the vendor at https://www.radiantviewer.com/files/RadiAnt-2026.1-Setup.exe, as referenced in CISA advisory ICSMA-26-218-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-218-01). Note: it has not been independently confirmed from available data whether 2026.1 is the patched release or an affected release - verify with the vendor before deploying. As a compensating control pending patch, restrict delivery of externally sourced DICOM files to trusted PACS systems only, and configure email and file-sharing controls to block or quarantine unsolicited DICOM attachments (files with .dcm, .dicom extensions or DICOM transfer syntax). Disabling automatic DICOM file preview in OS shell integrations reduces the passive interaction attack surface. These controls reduce exposure but do not eliminate risk if DICOM files from untrusted sources can reach the viewer through clinical workflows.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today