CVE-2026-49218: ImageMagick DCM Decoder DoS Vulnerability – CVSS 7.5

Technical summary

CVE-2026-49218 stems from insufficient validation in ImageMagick's DCM decoder module. The missing dimension-checking logic permits malformed DICOM images with out-of-bounds or logically invalid dimensions to be loaded and processed. Downstream image operations that assume valid dimensions can then encounter unhandled exceptions or memory access violations, resulting in application crashes. The vulnerability is classified under CWE-1284 (Improper Validation of Specified Type of Input for Data Structure) and CWE-20 (Improper Input Validation).

Business impact

Organizations using ImageMagick for automated image processing—such as web applications handling user uploads, medical imaging systems, or document conversion services—face service disruption risks. An attacker sending malicious DCM files can trigger crashes in the processing pipeline, degrading availability and potentially impacting customer-facing workflows. The attack requires no authentication or user interaction, making it a straightforward denial-of-service vector for externally accessible image processing endpoints.

Affected systems

ImageMagick versions prior to 6.9.13-48 (legacy branch) and 7.1.2-24 (current branch) are affected. Any deployment using an older version is vulnerable if it processes DCM files or accepts untrusted image inputs. This includes web servers with ImageMagick plugins, medical imaging software, and containerized microservices that perform image manipulation.

Exploitability

The vulnerability has a CVSS 3.1 score of 7.5 (HIGH), reflecting its network-accessible, low-complexity nature. The attack vector is straightforward: an attacker crafts a malicious DCM file with invalid dimensions and delivers it to an affected system (via upload form, API, or file processing queue). No privileges or user interaction are required. The impact is limited to availability (denial of service), not confidentiality or integrity. Exploit development is low-effort given the simplicity of crafting invalid DICOM headers.

Remediation

Upgrade ImageMagick to version 6.9.13-48 or later for the legacy 6.x branch, or to version 7.1.2-24 or later for the current 7.x branch. Verify the patched version is installed in all production environments, including embedded installations and container images. For systems that cannot be patched immediately, restrict DCM file processing or disable the DCM decoder module if alternative image formats suffice.

Patch guidance

Apply updates from the official ImageMagick repository or your distribution's package manager. For legacy 6.x users: verify installed version matches 6.9.13-48 or higher. For 7.x users: confirm version 7.1.2-24 or later is deployed. Test patched versions in staging before production rollout to ensure compatibility with dependent applications. Review any custom builds or statically linked ImageMagick binaries and recompile with the patched source code.

Detection guidance

Monitor ImageMagick process crashes or error logs for DCM-related failures (e.g., decoder exceptions, segmentation faults during image processing). Implement input validation upstream to reject malformed or suspicious DCM files before they reach ImageMagick. Log file names and sources of all processed images. Use YARA rules or file magic-number validation to identify DCM files with anomalous headers. In environments with user-supplied image uploads, validate image dimensions and structure prior to processing.

Why prioritize this

This vulnerability merits rapid patching because it enables unauthenticated denial-of-service attacks on internet-facing image processing systems. The low complexity of exploitation and absence of required privileges make it an attractive attack vector. Organizations with public-facing image upload features, medical imaging workflows, or automated batch image processing should prioritize patching within their standard critical-update cycle.

Risk score, explained

The CVSS 7.5 (HIGH) score reflects the combination of network accessibility, zero authentication requirements, and the denial-of-service impact. Absence from the CISA Known Exploited Vulnerabilities (KEV) catalog does not diminish urgency—the straightforward nature of the flaw means exploit development is trivial. Businesses should treat this as a HIGH priority based on their reliance on ImageMagick and exposure to untrusted image inputs.

Frequently asked questions