CVE-2026-49218: ImageMagick DCM Decoder DoS Vulnerability

CVE-2026-49218 Overview

CVE-2026-49218 affects ImageMagick, an open-source suite for editing and manipulating digital images. The vulnerability resides in the DCM (DICOM) decoder, where a missing validation check allows the decoder to accept images with invalid dimensions. Downstream operations consuming these malformed image objects can crash, producing a denial-of-service condition. The flaw is classified under [CWE-20] (Improper Input Validation) and is remotely triggerable when ImageMagick processes attacker-supplied DICOM files. Maintainers patched the issue in versions 6.9.13-48 and 7.1.2-24.

Critical Impact

A remote, unauthenticated attacker can supply a crafted DCM image to trigger crashes in any application or service that processes images through ImageMagick, leading to denial of service.

Affected Products

• ImageMagick versions prior to 6.9.13-48 (6.x branch)
• ImageMagick versions prior to 7.1.2-24 (7.x branch)
• Applications and services that embed ImageMagick for DCM/DICOM image processing

Discovery Timeline

• 2026-06-10 - CVE-2026-49218 published to the National Vulnerability Database
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-49218

Vulnerability Analysis

The vulnerability sits in ImageMagick's DCM decoder, the component responsible for parsing DICOM medical imaging files. The decoder fails to validate image dimension fields contained in the DCM header before constructing the in-memory image object. As a result, an image with invalid width or height values passes through decoding without rejection.

When subsequent ImageMagick operations attempt to process this object, assumptions about valid dimensions no longer hold. Pixel iteration, buffer allocation, and geometry calculations may dereference invalid pointers or trigger arithmetic faults. The outcome is a process crash that disrupts service availability.

Because ImageMagick is widely embedded in web applications, content management systems, and document pipelines, the attack surface extends well beyond standalone use.

Root Cause

The root cause is missing input validation [CWE-20] in the DCM decoder. The decoder accepts dimension metadata from the file without verifying that values are non-zero, positive, and within bounds supported by later processing routines. Trust in untrusted file input propagates into operations that assume valid geometry.

Attack Vector

An attacker crafts a malicious DCM file containing manipulated dimension fields and delivers it to any service that processes images via ImageMagick. Typical delivery paths include image upload endpoints, automated thumbnail generation, document conversion pipelines, and medical imaging workflows. No authentication or user interaction is required when the target service accepts unauthenticated uploads.

The vulnerability impacts availability only. Confidentiality and integrity are not affected based on the published CVSS vector. Refer to the GitHub Security Advisory GHSA-8pj9-6897-74xc for technical details from the maintainers.

Detection Methods for CVE-2026-49218

Indicators of Compromise

• Repeated crashes or restarts of processes that invoke convert, magick, or library functions from libMagickCore when handling user-supplied images
• Application logs showing aborted DCM decode operations or segmentation faults during image processing
• Inbound uploads of .dcm files to endpoints that do not normally process DICOM imagery

Detection Strategies

• Inventory installed ImageMagick versions across hosts and containers, flagging anything below 6.9.13-48 or 7.1.2-24
• Monitor process exit codes and core dumps for image conversion workers to identify abnormal termination patterns
• Inspect web application firewall and upload logs for DCM files submitted to endpoints expecting common formats such as JPEG or PNG

Monitoring Recommendations

• Alert on unexpected crashes of image processing workers, especially in batch or queue-based pipelines
• Track ImageMagick package versions through software bill of materials (SBOM) tooling and configuration management
• Forward decoder error messages and process termination events to a centralized logging platform for correlation

How to Mitigate CVE-2026-49218

Immediate Actions Required

• Upgrade ImageMagick to version 6.9.13-48 or 7.1.2-24 or later on all systems
• Audit container images, build pipelines, and third-party applications that bundle ImageMagick and rebuild with patched versions
• Restrict accepted image MIME types and file extensions at upload boundaries to formats actually required by the application

Patch Information

The ImageMagick maintainers fixed the missing dimension check in versions 6.9.13-48 and 7.1.2-24. The patched releases add validation in the DCM decoder to reject images with invalid dimensions before they propagate to other operations. Patch details and the upstream fix are documented in the GitHub Security Advisory GHSA-8pj9-6897-74xc.

Workarounds

• Disable the DCM coder in policy.xml if DICOM processing is not required by the application
• Run ImageMagick processes under resource limits and process isolation so that crashes do not impact the parent service
• Validate image dimensions and file headers using a separate, hardened parser before passing files to ImageMagick

# Disable the DCM decoder in ImageMagick policy.xml
# Add the following inside the <policymap> element
<policy domain="coder" rights="none" pattern="DCM" />