Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
RadiAnt is a DICOM viewer used to open and review medical images. CISA's advisory covers one vulnerability in versions below 2025.2.
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-17264 | Opening a crafted DICOM file with malicious JPEG-compressed pixel data triggers a heap out-of-bounds write, which may allow remote code execution (CWE-787) | Tampering, Elevation of privilege | Medium | Medium |
The published vector is network-reachable with no privileges, but a user has to open the file. That's why Exploitability reads Medium. CISA's published impact is Low availability only, so security impact reads Medium, and the security matrix gives Medium as published.
The description is more serious than the published impact. CISA's own text says the flaw may allow remote code execution, but the vector scores no confidentiality or integrity impact. If your product parses DICOM pixel data, don't inherit this vector. Score the impact for your own code path.
| Severity from your hazard analysis | Safety risk at Medium exploitability |
|---|---|
| Negligible | Low |
| Minor or Serious | Medium |
| Critical or Catastrophic | High |
Any software that parses medical images from outside sources faces the same risk: the image file itself becomes the attack.
What to check now
- Check whether your product uses RadiAnt below 2025.2, or a JPEG decoder in its DICOM pipeline with the same pattern.
- Fuzz your DICOM and image parsing paths, especially compressed pixel data.
- Update to version 2026.1, which CISA recommends, and open DICOM files only from trusted sources.
- If you're not affected, record that in a VEX statement with the justification.
- Re-score each affected threat in your cybersecurity risk assessment, and carry any patient-harm result into your ISO 14971 file.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.