Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Published: 2026-02-24
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and Information Disclosure
Action: Apply Patch
AI Analysis

Impact

ImageMagick contains a heap out‑of‑bounds read in the DCM decoder that occurs when processing certain DICOM files. The decoder loop mis‑calculates the number of bytes per iteration, causing the function to read beyond the allocated buffer. This flaw can lead either to a crash, denying legitimate use, or to leaking heap data into the output image, exposing sensitive information.

Affected Systems

The affected products are ImageMagick. Versions earlier than 7.1.2‑15 and 6.9.13‑40 are vulnerable; the patch that fixes the defect is included in those releases and later versions.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of less than 1% signals a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the processing of a specially crafted DICOM file; this can be local if a user invokes ImageMagick, or remote if the software is used as a service that accepts user input.

Generated by OpenCVE AI on April 16, 2026 at 16:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to version 7.1.2‑15 or newer, or 6.9.13‑40 or newer, where the DCM decoder bug has been fixed.
  • If an upgrade is not immediately possible, limit DICOM processing to trusted users or disable the DCM coder entirely.
  • Monitor ImageMagick logs for unexpected crashes or memory‑leak warnings related to DICOM inputs while the mitigation is in place.

Generated by OpenCVE AI on April 16, 2026 at 16:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4497-1 imagemagick security update
Debian DSA Debian DSA DSA-6158-1 imagemagick security update
Debian DSA Debian DSA DSA-6159-1 imagemagick security update
Github GHSA Github GHSA GHSA-pmq6-8289-hx3v ImageMagick has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)
History

Sat, 28 Feb 2026 02:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Tue, 24 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 24 Feb 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Imagemagick
Imagemagick imagemagick
Vendors & Products Imagemagick
Imagemagick imagemagick

Tue, 24 Feb 2026 02:00:00 +0000

Type Values Removed Values Added
Description ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Title ImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-02-28T02:03:58.629Z

Reserved: 2026-02-09T17:41:55.857Z

Link: CVE-2026-25982

cve-icon Vulnrichment

Updated: 2026-02-28T02:03:52.887Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-24T02:16:02.303

Modified: 2026-02-25T12:01:49.570

Link: CVE-2026-25982

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-02-24T01:40:45Z

Links: CVE-2026-25982 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T16:45:25Z

Weaknesses