LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A crafted JPEG inside a DICOM file overflows a viewer heap

MedDevice Cyber Staff · Aug 6 · 2 min read · Via CISA

RadiAnt DICOM returns with ICSMA-26-218-01, a different flaw from its 2025 update-channel bug. CVE-2026-17264, a heap-based buffer overflow triggered when the viewer opens a DICOM file with crafted JPEG-compressed pixel data.

A DICOM object is a container, and inside it the compressed pixel data is attacker-controlled input the parser has to handle safely. CISA advises updating to 2026.1 and only opening files from trusted sources, though in practice imaging software opens whatever a clinician receives.

If you write an image decoder, fuzz it with malformed inputs until it stops crashing, then keep fuzzing. The JPEG path inside DICOM is where memory-corruption bugs hide, and this year kept proving it.

Remediation Desk

Update RadiAnt DICOM to 2026.1 or later on every workstation that opens outside imagery. Until the fleet is patched, treat DICOM files that arrive from outside your own modalities as untrusted input and route them through a quarantine review.

Inventory RadiAnt installs. Check versions across reading workstations; anything at 2025.2 or earlier is exposed to CVE-2026-17264.
Push the 2026.1 update. The fix ships in RadiAnt DICOM 2026.1 per ICSMA-26-218-01. Prioritize workstations that receive CDs, USB media, or email-transferred studies.
Constrain untrusted imports. Open outside studies in a sandboxed or non-privileged account until patched, and strip auto-open handlers for DICOM media.
Fuzz your own parsers. If you ship an image decoder, run malformed-input fuzzing on the JPEG-in-DICOM path before an outside researcher does.

Sources

CISA ↗

Questions & Answers

What triggers CVE-2026-17264 in RadiAnt DICOM?

Maliciously crafted JPEG pixel data inside a DICOM file. When RadiAnt DICOM 2025.2 or earlier opens it, the crafted image overflows a heap buffer.

What is the realistic attack path?

Someone has to get the crafted file in front of the viewer, for example through an image sent into the workflow. It is rated medium because it needs that interaction rather than firing on its own.

How do you fix it?

Update RadiAnt DICOM past 2025.2 as directed in ICSMA-26-218-01. Handling images from outside your own systems with care reduces the exposure in the meantime.

← Back to Vulnerabilities