Out-of-bounds read in ImageMagick - CVE-2026-25982

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU123580

Out-of-bounds read in ImageMagick - CVE-2026-25982

Published: March 5, 2026


Vulnerability identifier: #VU123580
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-25982
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the coders/dcm.c module. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.


Affected software

ImageMagick
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
Development Tools Module
openEuler
imagemagick (Debian package)
ImageMagick-c++-devel
ImageMagick-help
ImageMagick-perl
ImageMagick-devel
ImageMagick-debugsource
ImageMagick-debuginfo
ImageMagick-c++
ImageMagick
ImageMagick-config-7-upstream-websafe
libMagickCore-7_Q16HDRI10
libMagickWand-7_Q16HDRI10-debuginfo
libMagick++-7_Q16HDRI5-debuginfo
ImageMagick-config-7-upstream-limited
libMagick++-7_Q16HDRI5
libMagick++-devel
libMagickCore-7_Q16HDRI10-debuginfo
ImageMagick-config-7-SUSE
ImageMagick-config-7-upstream-open
ImageMagick-config-7-upstream-secure
libMagickWand-7_Q16HDRI10
perl-PerlMagick
perl-PerlMagick-debuginfo

How to mitigate CVE-2026-25982

Install updates from vendor's website.

ImageMagick - addressed in versions 6.9.13-40, 7.1.2-15
imagemagick (Debian package) - addressed in versions 8:6.9.11.60+dfsg-1.6+deb12u7, 8:7.1.1.43+dfsg1-1+deb13u6
ImageMagick-c++-devel - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-help - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-perl - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-devel - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-debugsource - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-debuginfo - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-c++ - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-config-7-upstream-websafe - update to 7.1.1.43-150700.3.37.1
libMagickCore-7_Q16HDRI10 - update to 7.1.1.43-150700.3.37.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.37.1
ImageMagick - update to 7.1.1.43-150700.3.37.1
ImageMagick-debugsource - update to 7.1.1.43-150700.3.37.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.1.43-150700.3.37.1
ImageMagick-config-7-upstream-limited - update to 7.1.1.43-150700.3.37.1
ImageMagick-debuginfo - update to 7.1.1.43-150700.3.37.1
libMagick++-7_Q16HDRI5 - update to 7.1.1.43-150700.3.37.1
libMagick++-devel - update to 7.1.1.43-150700.3.37.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.37.1
ImageMagick-config-7-SUSE - update to 7.1.1.43-150700.3.37.1
ImageMagick-devel - update to 7.1.1.43-150700.3.37.1
ImageMagick-config-7-upstream-open - update to 7.1.1.43-150700.3.37.1
ImageMagick-config-7-upstream-secure - update to 7.1.1.43-150700.3.37.1
libMagickWand-7_Q16HDRI10 - update to 7.1.1.43-150700.3.37.1
perl-PerlMagick - update to 7.1.1.43-150700.3.37.1
perl-PerlMagick-debuginfo - update to 7.1.1.43-150700.3.37.1

External References

Related Security Bulletins