CVE-2026-56370

What it actually does

ImageMagick versions before 7.1.2-19 contain an out-of-bounds memory access flaw in ConnectedComponentsImage() when malformed connected-components artifacts reference invalid indices. When ImageMagick processes attacker-controlled connected-components definitions through the CLI or an application wrapper, the process can read or write outside expected memory bounds, typically causing a crash. Depending on build options, allocator behavior, platform protections, and the exact malformed input, memory corruption could theoretically be shaped toward code execution, but the published exploit maturity is currently none and the assessed severity is low.

Why it matters to the business

The most likely operational impact is denial of service in systems that rely on ImageMagick for image analysis, conversion, thumbnailing, document preview generation, or automated media processing. An attacker who can influence image-processing inputs or command-line options may be able to crash conversion workers, interrupt upload pipelines, increase job retry volume, or degrade application availability. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS probability, and has no known public exploit maturity, but ImageMagick is widely embedded in downstream software and container images, so exposure may exist indirectly through applications and automation that invoke ImageMagick.

How an attack unfolds

An attacker first identifies a workflow that invokes ImageMagick with connected-components processing or allows user-controlled processing options to reach the ImageMagick CLI or API. The attacker then supplies malformed connected-components artifact definitions that contain invalid component indices. When the vulnerable ImageMagick process evaluates those artifacts inside ConnectedComponentsImage(), it accesses memory outside the expected bounds. In the common case, the process terminates with a segmentation fault, access violation, abort, or similar crash, causing the conversion or analysis job to fail. In less likely scenarios, if the memory corruption can be made reliable on a specific target build, the same primitive could potentially be developed into code execution within the privileges of the ImageMagick process or the calling service account.

How to fix it

Upgrade ImageMagick to version 7.1.2-19 or later wherever it is installed, embedded, statically linked, or included in container images. Rebuild applications and containers that vendor ImageMagick libraries rather than relying only on the operating system package manager. If an immediate upgrade is not possible, reduce exposure by disabling or restricting untrusted use of connected-components processing, preventing users from controlling ImageMagick command-line options, running ImageMagick under a low-privilege service account, enforcing resource limits, isolating image conversion workers in containers or sandboxes, and monitoring/restarting failed workers safely. Ensure dependent packages, language bindings, and image-processing services are updated to use the fixed ImageMagick runtime.

How to confirm the fix worked

Confirm remediation by checking the runtime version with commands such as `magick -version`, `convert -version`, package manager inventory, container SBOMs, and application dependency manifests, and verify that the active runtime is ImageMagick 7.1.2-19 or later. For containerized or bundled deployments, inspect the built image or binary actually used in production rather than only the base host. Confirm that user input cannot directly control ImageMagick CLI arguments or connected-components artifact definitions. Validate operationally by processing normal connected-components workloads and confirming successful completion without crashes. Review application, worker, and system logs after remediation to ensure there are no continuing ImageMagick segmentation faults, access violations, or repeated abnormal exits during image-processing jobs.

Typical attack path

1. Find an application, batch job, API, or local workflow that uses ImageMagick for image processing.
2. Determine whether connected-components processing is enabled or whether attacker-controlled CLI/API options can influence ImageMagick artifacts.
3. Submit or cause processing of malformed connected-components definitions containing invalid indices.
4. Trigger the vulnerable ConnectedComponentsImage() code path in an ImageMagick version before 7.1.2-19.
5. Cause the ImageMagick process to crash, interrupting the calling application or worker process.
6. Optionally attempt repeated submissions to create sustained denial of service or explore memory-corruption behavior for potential code execution.

How to detect it

To determine whether this was already exploited, review process execution logs, EDR telemetry, application upload/conversion logs, worker job logs, web server request logs, system crash logs, container logs, and core-dump records for ImageMagick crashes associated with connected-components processing. On Linux and Unix-like systems, look for `magick` or `convert` exiting with segmentation faults, signal 11, SIGSEGV, aborts, or exit code 139 shortly after processing untrusted images or user-submitted jobs. On Windows, look for ImageMagick process failures with exception code 0xc0000005. Correlate crashes with command lines containing `-connected-components` or `connected-components:` defines, suspiciously repeated failed conversion jobs, unusual user submissions immediately before worker restarts, and generated core dumps referencing ImageMagick. There are no known public exploit payloads, hashes, or named threat actors for this issue, so detection should focus on behavioral evidence of malformed connected-components processing and abnormal ImageMagick termination.

• -connected-components
• connected-components:
• ConnectedComponentsImage
• magick: Segmentation fault
• convert: Segmentation fault
• Segmentation fault (core dumped)
• SIGSEGV
• signal 11
• exit status 139
• exit code 139
• Exception code: 0xc0000005
• Application Error: magick.exe
• Application Error: convert.exe
• core.magick
• core.convert
• /var/lib/systemd/coredump/core.magick
• /var/lib/systemd/coredump/core.convert

What your security team should do

• Inventory all direct and indirect ImageMagick deployments, including containers, CI/CD images, serverless packages, desktop tooling, media services, and applications using ImageMagick bindings.
• Prioritize upgrade to ImageMagick 7.1.2-19 or later for internet-facing upload, preview, thumbnail, conversion, and document-processing services.
• Search execution telemetry and application logs for ImageMagick invocations using connected-components options, especially where arguments may be influenced by untrusted users.
• Harden image-processing services by removing user control over CLI options, using allowlisted transformations, and running conversion workers with least privilege and resource constraints.
• Enable crash and core-dump collection for image-processing workers temporarily to identify possible exploitation attempts or malformed input triggering the vulnerable path.
• Add monitoring for repeated `magick` or `convert` crashes, exit code 139 on Unix-like systems, and access violation code 0xc0000005 on Windows.
• Rebuild and redeploy containers or application artifacts that include ImageMagick rather than assuming host-level patching is sufficient.