ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

CAO 7.5CVE-2026-49218 · GHSA-8pj9-6897-74xc · Công bố 10/06/2026 · cập nhật 23/07/2026

Tóm tắt nhanh

CVE-2026-49218 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, Magick.NET-Q16-HDRI-OpenMP-arm64.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.35%, cao hơn 28.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 14.14.0, 7.1.2-24, 6.9.13-48 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
Magick.NET-Q16-AnyCPU NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-HDRI-AnyCPU NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-HDRI-OpenMP-arm64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-HDRI-arm64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-HDRI-x64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-HDRI-x86 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-OpenMP-arm64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-OpenMP-x64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-arm64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-x64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q16-x86 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q8-AnyCPU NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q8-OpenMP-arm64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q8-OpenMP-x64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q8-arm64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q8-x64 NuGet	`< 14.14.0`	`14.14.0`
Magick.NET-Q8-x86 NuGet	`< 14.14.0`	`14.14.0`
imagemagick imagemagick	`≥ 7.0.0-0, < 7.1.2-24< 6.9.13-48`	`7.1.2-246.9.13-48`

Mô tả

A missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operations.

Mô tả của NVD

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.