Medium
Security advisory
There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-16644
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:19 UTC · Revision 1
Source evidence
There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.
osv:CVE-2018-16644
Complete source record
{
"id": "7d87e8541bad3f35385696512a6faece5dad0faccdcb3e603ca38735a5052b0e",
"url": "https://osv.dev/vulnerability/CVE-2018-16644",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-16644",
"summary": "There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.",
"evidence": "osv:CVE-2018-16644",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-16644",
"aliases": [
"CVE-2018-16644"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick",
"type": "GIT",
"events": [
{
"introduced": "fffaf414885c9b8f741477e2b344423df5ea721d"
},
{
"last_affected": "fffaf414885c9b8f741477e2b344423df5ea721d"
},
{
"fixed": "16916c8979c32765c542e216b31cee2671b7afe7"
},
{
"fixed": "afa878a689870c28b6994ecf3bb8dbfb2b76d135"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.8-11:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.8-11"
},
{
"last_affected": "7.0.8-11"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "16916c8979c32765c542e216b31cee2671b7afe7"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "afa878a689870c28b6994ecf3bb8dbfb2b76d135"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"7.0.8-11"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16644.json",
"vanir_signatures": [
{
"id": "CVE-2018-16644-151fd89c",
"digest": {
"length": 27685,
"function_hash": "216344764721089435425809697740891896637"
},
"source": "https://github.com/imagemagick/imagemagick/commit/16916c8979c32765c542e216b31cee2671b7afe7",
"target": {
"file": "coders/dcm.c",
"function": "ReadDCMImage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-16644-2dcbff7c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"282532765129590003694466301263899582732",
"28575460015977794251610399265088909547",
"217428959336495974744478309101155832700",
"91983129253813061800588339833023037686",
"37483863734739795505907049196586496695",
"55601521399508558922552616954761080836",
"222108361130992487661678340231729585411",
"45267993873415893655198510725235563523",
"102861351974321239463654041454065620485",
"230821806491836518422991815357813878619",
"315261130184466075111194072546714799232",
"12916301218640047330922904718861499059",
"111257503344439224121001840319533509963",
"112100833970445811542922415959476143205",
"335062944483755306039754672033561531573",
"234530208679493171825701544464978158847",
"161688064976702416054686415126221409005",
"327824439739758784225876323002098557415",
"335062944483755306039754672033561531573",
"234530208679493171825701544464978158847",
"171282357923086536838539842662062027402",
"309104253251563304176823317934882032628",
"235383814969330485333753363194890716155",
"302836472018851990782674805463554345027",
"205389503708690087342682217076531245574",
"335375314649863373442602802043992734059",
"141330677716083687253799837651004802193",
"241603333444238604478965794023226202297",
"112957699429535062050344174691128768070",
"43205081347224939791448762780325004508",
"295765431739850849530213121397589924738",
"66636134402260882666810542486448256827",
"30716425759604132704142046334492865436",
"247883289141306761883263428253879634356",
"183025716017305886973560224867389431433",
"34483684178405649285224538896685681856"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/afa878a689870c28b6994ecf3bb8dbfb2b76d135",
"target": {
"file": "coders/pict.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16644-3eded309",
"digest": {
"threshold": 0.9,
"line_hashes": [
"196241113006705054470804958438605567720",
"263961331765887318856875363007917119891",
"126978134994261841828292926358304326723",
"156422671895451978979885945500638271676"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/16916c8979c32765c542e216b31cee2671b7afe7",
"target": {
"file": "coders/dcm.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16644-e82b9979",
"digest": {
"length": 15934,
"function_hash": "325129785612070796534989567550768104245"
},
"source": "https://github.com/imagemagick/imagemagick/commit/afa878a689870c28b6994ecf3bb8dbfb2b76d135",
"target": {
"file": "coders/pict.c",
"function": "ReadPICTImage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:12:15Z"
}
}
],
"modified": "2026-10-24T14:12:15.482250965Z",
"provider": "osv",
"references": [
"https://usn.ubuntu.com/4034-1/",
"https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html",
"https://usn.ubuntu.com/3785-1/",
"https://www.debian.org/security/2018/dsa-4316",
"https://github.com/ImageMagick/ImageMagick/commit/16916c8979c32765c542e216b31cee2671b7afe7",
"https://github.com/ImageMagick/ImageMagick/commit/afa878a689870c28b6994ecf3bb8dbfb2b76d135",
"https://github.com/ImageMagick/ImageMagick/issues/1269"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:7.0.8-11:*:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"introduced": "7.0.8-11"
},
{
"last_affected": "7.0.8-11"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-16644",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443377,
"published_at": "2018-09-06T22:29:01.287+00:00"
}