{"id":"CVE-2026-56370","aliases":["GHSA-pmpg-6pww-fg6q"],"title":"ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts","summary":"ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts","severity":"low","cvss":3.3,"cwe":["CWE-125","CWE-787"],"vendor":"Magick","product":"Magick.NET-Q16-AnyCPU","ecosystem":"nuget","affected":["Magick.NET-Q16-AnyCPU < 14.12.0","Magick.NET-Q16-HDRI-AnyCPU < 14.12.0","Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0","Magick.NET-Q16-HDRI-arm64 < 14.12.0","Magick.NET-Q16-HDRI-x64 < 14.12.0","Magick.NET-Q16-HDRI-x86 < 14.12.0","Magick.NET-Q16-OpenMP-arm64 < 14.12.0","Magick.NET-Q16-OpenMP-x64 < 14.12.0","Magick.NET-Q16-arm64 < 14.12.0","Magick.NET-Q16-x64 < 14.12.0","Magick.NET-Q16-x86 < 14.12.0","Magick.NET-Q16-HDRI-OpenMP-x64 < 14.12.0","Magick.NET-Q8-AnyCPU < 14.12.0","Magick.NET-Q8-OpenMP-arm64 < 14.12.0","Magick.NET-Q8-OpenMP-x64 < 14.12.0","Magick.NET-Q8-arm64 < 14.12.0","Magick.NET-Q8-x64 < 14.12.0","Magick.NET-Q8-x86 < 14.12.0"],"patched":["Magick.NET-Q16-AnyCPU 14.12.0","Magick.NET-Q16-HDRI-AnyCPU 14.12.0","Magick.NET-Q16-HDRI-OpenMP-arm64 14.12.0","Magick.NET-Q16-HDRI-arm64 14.12.0","Magick.NET-Q16-HDRI-x64 14.12.0","Magick.NET-Q16-HDRI-x86 14.12.0","Magick.NET-Q16-OpenMP-arm64 14.12.0","Magick.NET-Q16-OpenMP-x64 14.12.0","Magick.NET-Q16-arm64 14.12.0","Magick.NET-Q16-x64 14.12.0","Magick.NET-Q16-x86 14.12.0","Magick.NET-Q16-HDRI-OpenMP-x64 14.12.0","Magick.NET-Q8-AnyCPU 14.12.0","Magick.NET-Q8-OpenMP-arm64 14.12.0","Magick.NET-Q8-OpenMP-x64 14.12.0","Magick.NET-Q8-arm64 14.12.0","Magick.NET-Q8-x64 14.12.0","Magick.NET-Q8-x86 14.12.0"],"published":"2026-04-14","updated":"2026-09-18","sourceUpdated":"2026-09-18T21:02:19Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pmpg-6pww-fg6q","references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmpg-6pww-fg6q"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56370"},{"url":"https://www.vulncheck.com/advisories/imagemagick-out-of-bounds-access-in-connectedcomponentsimage-via-connected-components-artifact"},{"url":"https://github.com/advisories/GHSA-pmpg-6pww-fg6q"}],"tags":["ghsa","nuget"],"epss":0.00121,"epssPercentile":0.02226,"ingestedAt":"2026-09-18T21:53:15.792Z","slug":"CVE-2026-56370","body":"## Overview\n\nWhen the `connected-components:*` define specifies an invalid index and out of bound operation will result in an access violation.\n\n## Affected packages\n\n- `Magick.NET-Q16-AnyCPU < 14.12.0`\n- `Magick.NET-Q16-HDRI-AnyCPU < 14.12.0`\n- `Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0`\n- `Magick.NET-Q16-HDRI-arm64 < 14.12.0`\n- `Magick.NET-Q16-HDRI-x64 < 14.12.0`\n- `Magick.NET-Q16-HDRI-x86 < 14.12.0`\n- `Magick.NET-Q16-OpenMP-arm64 < 14.12.0`\n- `Magick.NET-Q16-OpenMP-x64 < 14.12.0`\n- `Magick.NET-Q16-arm64 < 14.12.0`\n- `Magick.NET-Q16-x64 < 14.12.0`\n- `Magick.NET-Q16-x86 < 14.12.0`\n- `Magick.NET-Q16-HDRI-OpenMP-x64 < 14.12.0`\n- `Magick.NET-Q8-AnyCPU < 14.12.0`\n- `Magick.NET-Q8-OpenMP-arm64 < 14.12.0`\n- `Magick.NET-Q8-OpenMP-x64 < 14.12.0`\n- `Magick.NET-Q8-arm64 < 14.12.0`\n- `Magick.NET-Q8-x64 < 14.12.0`\n- `Magick.NET-Q8-x86 < 14.12.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `Magick.NET-Q16-AnyCPU 14.12.0`\n- `Magick.NET-Q16-HDRI-AnyCPU 14.12.0`\n- `Magick.NET-Q16-HDRI-OpenMP-arm64 14.12.0`\n- `Magick.NET-Q16-HDRI-arm64 14.12.0`\n- `Magick.NET-Q16-HDRI-x64 14.12.0`\n- `Magick.NET-Q16-HDRI-x86 14.12.0`\n- `Magick.NET-Q16-OpenMP-arm64 14.12.0`\n- `Magick.NET-Q16-OpenMP-x64 14.12.0`\n- `Magick.NET-Q16-arm64 14.12.0`\n- `Magick.NET-Q16-x64 14.12.0`\n- `Magick.NET-Q16-x86 14.12.0`\n- `Magick.NET-Q16-HDRI-OpenMP-x64 14.12.0`\n- `Magick.NET-Q8-AnyCPU 14.12.0`\n- `Magick.NET-Q8-OpenMP-arm64 14.12.0`\n- `Magick.NET-Q8-OpenMP-x64 14.12.0`\n- `Magick.NET-Q8-arm64 14.12.0`\n- `Magick.NET-Q8-x64 14.12.0`\n- `Magick.NET-Q8-x86 14.12.0`","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}