CVE-2026-25982: 
C# vulnerability analysis and mitigation

CVE-2026-25982 is a heap out-of-bounds read vulnerability in ImageMagick's DICOM file decoder (coders/dcm.c), capable of causing Denial of Service or Information Disclosure. It affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026, with patches released simultaneously. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Github Advisory DB).

The root cause is an out-of-bounds read (CWE-125) in the ReadDCMImage function within coders/dcm.c. When processing DICOM image files with a specific decoder configuration, the loop incorrectly calculates the number of bytes to read per iteration, causing it to read past the end of the allocated heap buffer. The vulnerability is network-exploitable with no authentication or user interaction required — an attacker simply needs to supply a crafted DICOM file to an application that uses ImageMagick for image processing. The issue was reported by researcher marckwei and patched by the ImageMagick maintainer dlemstra (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in two primary outcomes: a Denial of Service via application crash when ImageMagick processes a malicious DICOM file, or Information Disclosure where heap memory contents are leaked into the output image, potentially exposing sensitive in-memory data. Integrity is not impacted. The scope is limited to the affected component, but in environments where ImageMagick processes DICOM files from untrusted sources (e.g., medical imaging web applications), the memory disclosure could expose sensitive runtime data (GitHub Advisory, Feedly).

1. Identify target: Locate a service or application that uses a vulnerable version of ImageMagick (< 7.1.2-15 or < 6.9.13-40) or Magick.NET (< 14.10.3) to process user-supplied DICOM (.dcm) files — such as a medical imaging portal or file conversion service.
2. Craft malicious DICOM file: Create a specially crafted DICOM file with a configuration that triggers the incorrect byte-per-iteration calculation in the ReadDCMImage decoder loop within coders/dcm.c.
3. Submit the file: Upload or submit the crafted DICOM file to the target application via any available file upload or image processing endpoint.
4. Trigger out-of-bounds read: ImageMagick processes the file, and the decoder reads past the end of the allocated heap buffer.
5. Achieve objective: Depending on the environment, the attacker either causes a crash (DoS) or receives output containing leaked heap memory embedded in the resulting image data, which may include sensitive in-memory information (GitHub Advisory).

• Logs: Application logs showing ImageMagick crashes or segmentation faults when processing .dcm files; error messages referencing coders/dcm.c or ReadDCMImage.
• File System: Unexpected or malformed DICOM files submitted to image processing directories; core dump files generated by ImageMagick processes.
• Process: Abnormal termination of ImageMagick worker processes (convert, magick) immediately after processing DICOM input.
• Network: Repeated submission of DICOM files from a single source IP to an image processing endpoint, particularly if followed by retrieval of the processed output image.

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). For Magick.NET users, upgrade to version 14.10.3 or later. As a workaround where immediate patching is not feasible, restrict DICOM file processing to trusted sources only, implement input validation, and consider sandboxing ImageMagick operations. Linux distribution packages (Debian, SUSE, Amazon Linux 2) have also released updated packages incorporating the fix (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked the vulnerability via their Bugzilla system and assigned it medium severity, with downstream package updates issued for multiple Linux distributions including Debian (DSA-6158, DSA-6159, DLA-4497), SUSE, and Amazon Linux 2. The openSUSE Tumbleweed March 2026 monthly update also included the fix. No notable public researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution advisories.