PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49218 ImageMagick CVE debrief

CVE-2026-49218 is a HIGH severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. A missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operations. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

Vendor
ImageMagick
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick versions prior to 6.9.13-48 and 7.1.2-24 should apply the patches to prevent potential crashes caused by maliciously crafted images.

Technical summary

The vulnerability exists in the DCM decoder of ImageMagick. A missing check could lead to images with invalid dimensions, potentially causing crashes in other operations. The CVSS score for this vulnerability is 7.5, indicating a HIGH severity.

Defensive priority

HIGH

Recommended defensive actions

  • Apply patches: Upgrade to ImageMagick versions 6.9.13-48 or 7.1.2-24 or later.
  • Restrict image processing: Limit the processing of untrusted images until patched versions are deployed.

Evidence notes

The CVE-2026-49218 vulnerability was published on [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-49218) and detailed on [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-49218).

Official resources

CVE-2026-49218 was published on 2026-06-10T23:16:49.500Z and modified on 2026-06-11T18:44:28.637Z.