CVE-2026-56370Low· 3.3▾ SunlitImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.1%
When the connected-components:* define specifies an invalid index and out of bound operation will result in an access violation.
Magick.NET-Q16-AnyCPU < 14.12.0Magick.NET-Q16-HDRI-AnyCPU < 14.12.0Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0Magick.NET-Q16-HDRI-arm64 < 14.12.0Magick.NET-Q16-HDRI-x64 < 14.12.0Magick.NET-Q16-HDRI-x86 < 14.12.0Magick.NET-Q16-OpenMP-arm64 < 14.12.0Magick.NET-Q16-OpenMP-x64 < 14.12.0Magick.NET-Q16-arm64 < 14.12.0Magick.NET-Q16-x64 < 14.12.0Magick.NET-Q16-x86 < 14.12.0Magick.NET-Q16-HDRI-OpenMP-x64 < 14.12.0Magick.NET-Q8-AnyCPU < 14.12.0Magick.NET-Q8-OpenMP-arm64 < 14.12.0Magick.NET-Q8-OpenMP-x64 < 14.12.0Magick.NET-Q8-arm64 < 14.12.0Magick.NET-Q8-x64 < 14.12.0Magick.NET-Q8-x86 < 14.12.0Upgrade to a patched release:
Magick.NET-Q16-AnyCPU 14.12.0Magick.NET-Q16-HDRI-AnyCPU 14.12.0Magick.NET-Q16-HDRI-OpenMP-arm64 14.12.0Magick.NET-Q16-HDRI-arm64 14.12.0Magick.NET-Q16-HDRI-x64 14.12.0Magick.NET-Q16-HDRI-x86 14.12.0Magick.NET-Q16-OpenMP-arm64 14.12.0Magick.NET-Q16-OpenMP-x64 14.12.0Magick.NET-Q16-arm64 14.12.0Magick.NET-Q16-x64 14.12.0Magick.NET-Q16-x86 14.12.0Magick.NET-Q16-HDRI-OpenMP-x64 14.12.0Magick.NET-Q8-AnyCPU 14.12.0Magick.NET-Q8-OpenMP-arm64 14.12.0Magick.NET-Q8-OpenMP-x64 14.12.0Magick.NET-Q8-arm64 14.12.0Magick.NET-Q8-x64 14.12.0Magick.NET-Q8-x86 14.12.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-62363Medium· 5.0ImageMagick: Heap Buffer Over-Write in fx operation
GHSA-hwf3-r46v-5ggxLow· 2.9ImageMagick: Information Disclosure when printing profiles with debug enabled
CVE-2026-55597Medium· 5.5ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
CVE-2026-53465Medium· 6.2ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image
CVE-2026-48724Medium· 5.5ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method
CVE-2026-53461High· 7.5ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop