Executive Summary

CVE-2026-25982 is a moderate severity vulnerability in the ImageMagick software, specifically in the coders/dcm.c module that handles decoding of DICOM files.

The issue occurs when the decoder loop processes DICOM files with certain configurations and incorrectly reads bytes per iteration, causing it to read beyond the allocated heap buffer boundary.

This out-of-bounds read can lead to a Denial of Service (application crash) or Information Disclosure by leaking heap memory into the processed image.

The vulnerability affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40, which contain patches to fix this issue.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade ImageMagick to version 7.1.2-15 or later, or 6.9.13-40 or later, where the vulnerability has been patched.

Additionally, avoid processing untrusted or malformed DICOM files until the update is applied to prevent potential Denial of Service or Information Disclosure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a Denial of Service, where the ImageMagick application crashes when processing specially crafted DICOM files.

Additionally, it can lead to Information Disclosure by leaking heap memory contents into the processed image, potentially exposing sensitive data.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability exists in ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 when processing DICOM files. Detection involves identifying if vulnerable versions of ImageMagick are installed and if DICOM files are being processed.

You can check the installed ImageMagick version with the command:

• magick -version

To detect attempts to exploit this vulnerability, monitor logs or network traffic for unusual crashes or errors related to ImageMagick processing DICOM files.

No specific detection commands or signatures are provided in the available resources.

Useful 0 Not Useful 0