CVE-2026-56370

An out-of-bounds access vulnerability exists in ImageMagick's ConnectedComponentsImage() function. By passing malformed connected-components definitions through the CLI, an attacker can cause a denial of service or potentially execute arbitrary code.

An out-of-bounds access flaw exists in ImageMagick when handling malformed connected-components artifacts. Exploitation requires local user interaction via the CLI and can result in a denial of service or arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the injection of malformed -connected-components flags by strictly sanitizing all user-supplied CLI input in backend applications. Additionally, if automated ImageMagick processing is not required, restrict execution permissions on the binaries to trusted administrative groups.