CVE-2026-56370

—

CVSS 4.0

4.8 medium

EPSS

<1%p7

Published

Jun 24, 2026 (Jun 24, 2026)

Modified

Jun 26, 2026

Description

ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution.

Vendors: imagemagick
Products: imagemagick
Weakness: CWE-125
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news1 stories

USN-8739-1: ImageMagick vulnerabilities

Canonical released USN-8739-1 fixing five ImageMagick flaws that could cause denial of service or arbitrary code execution.

Ubuntu security notice USN-8739-1 patches five ImageMagick vulnerabilities: CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, and CVE-2026-56373 allow denial of service via crafted images on Ubuntu 14.04 through 22.04 LTS. CVE-2026-56370 affects Ubuntu 22.04 LTS and 26.04 LTS and could allow denial of service or arbitrary code execution. Users should apply the updated ImageMagick packages to affected releases.

Ubuntu Security NoticesSep 8, 18:30 UTC · 7d agoAdvisory CVE-2026-56366 CVE-2026-56368 CVE-2026-56370+2 CVEs