ImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)

Vulnerability

Overview

CVE-2026-25982 is a heap out-of-bounds read vulnerability in ImageMagick's DICOM decoder, located in the coders/dcm.c module. The root cause is an incorrect byte-per-iteration calculation in the decoder loop when processing specially crafted DICOM files. This flaw causes the function to read beyond the allocated buffer boundary, leading to undefined behavior [2][4].

Exploitation and

Attack Surface

An attacker can exploit this vulnerability by supplying a malicious DICOM image to an application or service that uses ImageMagick to process images. No authentication is required, and the attack can be performed remotely if the victim processes the crafted file. The vulnerability is triggered during the decoding phase, before any image data is rendered, making it accessible through common image processing pipelines [2][4].

Impact

Successful exploitation can result in a denial of service (application crash) or information disclosure, where heap memory contents may be leaked into the output image. The leaked memory could contain sensitive data from other processes or the operating system, depending on the heap state at the time of the read [2][4].

Mitigation

The vulnerability has been patched in ImageMagick versions 7.1.2-15 and 6.9.13-40. Users should update to these or later versions immediately. No workarounds are documented, but restricting DICOM file processing to trusted sources can reduce risk [2][4].