ImageMagick Heap Out-of-Bounds Read Vulnerability in DCM Decoder

A heap out-of-bounds read vulnerability has been identified in ImageMagick versions prior to 7.1.2-15 and 6.9.13-40. The issue resides in the 'coders/dcm.c' module, where the DICOM file decoder loop improperly calculates bytes per iteration. This flaw allows the function to read beyond the allocated buffer's end, potentially causing a crash (Denial of Service) or leaking heap memory into the image (Information Disclosure).

Impact

Exploitation of this vulnerability can lead to a crash of the ImageMagick process (Denial of Service) or unintended disclosure of heap memory contents through the processed image.

Remediation

Users can upgrade to ImageMagick versions 7.1.2-15 or 6.9.13-40 to address this vulnerability.