7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49218

CVE-2026-49218: ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49218

CVE-2026-49218:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x86	nuget	< 14.14.0	14.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided security advisory GHSA-8pj9-6897-74xc, which pointed to a policy bypass in the DCM decoder of ImageMagick. The vulnerability allowed for the creation of an image with invalid (zero) dimensions, which could lead to application crashes. To pinpoint the exact vulnerable function, I identified the patch by comparing the repository tags before and after the disclosed patched version. The commit 84fbcef8a558b1da075417a89d29aa5632d57f63 was identified as the fix, with a clear commit message linking to the security advisory. The commit modified the coders/dcm.c file, specifically within the ReadDCMImage function. The patch added a crucial check to validate that the image's rows and columns are not zero after the image is read. This confirms that ReadDCMImage is the vulnerable function, as it was the point where the invalid image was allowed to be created without proper validation.

Vulnerable functions

ReadDCMImage

coders/dcm.c

The vulnerability lies in the `ReadDCMImage` function, which is responsible for decoding DCM images. Prior to the patch, this function did not validate whether the image dimensions (rows and columns) were zero. This omission allowed the processing of DCM files with invalid headers, leading to the creation of an image with zero dimensions. Subsequent operations on this invalid image could then cause crashes or other undefined behavior. The patch introduces a check to ensure that if an image is produced, it has valid, non-zero dimensions, throwing a `CorruptImageError` otherwise.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.