# CVE-2026-25982: Magick.NET-Q16 — Fixed in 14.10.3 .NET .NET NuGet Not in CISA KEV MEDIUM severity # CVE-2026-25982 — Magick.NET-Q16-AnyCPU MEDIUM CVE-2026-25982 is a medium-severity (CVSS 6.5) Out-of-bounds Read vulnerability in Magick.NET-Q16-AnyCPU. A fix is available for Magick.NET-Q16-AnyCPU — see the affected versions and patch details below. ImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage) Also known as[GHSA-pmq6-8289-hx3v](/vulnerability/GHSA-pmq6-8289-hx3v) Published Feb 24, 2026 Updated Oct 28, 2026 Affected 19 pkgs Patched 19 / 19 Exploits None indexed Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25982. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.4%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs33th percentile — riskier than 33% of all scored CVEsHighest risk 0.00%0.30%0.59%0.89%0.0%0.4%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 19 pkgs affected .NET`Magick.NET-Q16-AnyCPU`.NET`Magick.NET-Q16-HDRI-AnyCPU`.NET`Magick.NET-Q16-HDRI-OpenMP-arm64`.NET`Magick.NET-Q16-HDRI-arm64`.NET`Magick.NET-Q16-HDRI-x64`.NET`Magick.NET-Q16-HDRI-x86`.NET`Magick.NET-Q16-OpenMP-arm64`.NET`Magick.NET-Q16-OpenMP-x64`+11 more Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems. ## Description ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch. ## Affected Packages 19 total 19 fixed Ecosystem Package Vulnerable range Fix .NETNuGet `Magick.NET-Q16-AnyCPU` all versions 14.10.3`dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3` .NETNuGet `Magick.NET-Q16-HDRI-AnyCPU` all versions 14.10.3`dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3` .NETNuGet `Magick.NET-Q16-HDRI-OpenMP-arm64` all versions 14.10.3`dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3` .NETNuGet `Magick.NET-Q16-HDRI-arm64` all versions 14.10.3`dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3` .NETNuGet `Magick.NET-Q16-HDRI-x64` all versions 14.10.3`dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3` .NETNuGet `Magick.NET-Q16-HDRI-x86` all versions 14.10.3`dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3` ## Affected Products 1 product · 2 configurations Application `imagemagick`imagemagick ≥ 7.0.0-0 && < 7.1.2-15 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Magick.NET-Q16-AnyCPU, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update Magick.NET-Q16-AnyCPU to 14.10.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25982 is resolved across your whole dependency graph. 3. ### Workarounds Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatModerate This MODERATE impact vulnerability in ImageMagick's DCM decoder allows for a heap out-of-bounds read when processing specially crafted DICOM files. This could lead to a denial of service or information disclosure. Red Hat Enterprise Linux and Community Projects are affected if ImageMagick is used to process untrusted… Workaround published by Red Hat > To mitigate this issue, avoid processing untrusted DICOM files with ImageMagick. If ImageMagick is utilized by a network service, restrict access to that service to trusted users and networks. Source: [Red Hat security advisory for CVE-2026-25982](https://access.redhat.com/security/cve/cve-2026-25982) (CC BY 4.0) ## Frequently Asked Questions ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the \`coders/dcm.c\` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch. O3 Security · Impact-Aware SCA ### Is CVE-2026-25982 in your dependencies? Find it across NuGet, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)