ImageMagick CVE-2026-56370

Exploitation requires that an attacker control the connected-components:* artifact definitions passed to ImageMagick via the CLI, either directly (local shell access without elevated privileges) or indirectly through an application that constructs ImageMagick CLI invocations from attacker-influenced input. The CVSS vector specifies UI:P (passive user interaction), meaning a human or automated process must invoke ImageMagick against the malformed input. Exploitation is limited by the local attack vector (AV:L) - purely network-reachable exploitation without some intermediate application layer constructing the CLI call is not supported by the available data. No authentication is required to run the ImageMagick CLI itself (PR:N), but an attacker must reach a context where they can influence CLI arguments or provide a specially crafted input file to a process that uses connected-components functionality.

The CVSS 4.0 score of 4.8 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N reflects a local, low-complexity attack requiring passive user interaction, with only low availability impact on the vulnerable system. This is a conservative scoring - the vendor tags include RCE and Information Disclosure, which are not reflected in the VC:N/VI:N vector metrics. There is a notable tension between the tags and the CVSS vector: the CWE-125 (OOB Read) root cause can yield memory disclosure and, under favorable attacker-controlled conditions, code execution, yet the 4.0 vector does not assign confidentiality or integrity impact. This discrepancy should be verified with the vendor advisory (GHSA-pmpg-6pww-fg6q). No EPSS score was provided in the input data. The vulnerability is not in CISA KEV and no public proof-of-concept exploit is identified at time of analysis, which substantially lowers near-term operational risk. However, environments that pipe untrusted user-supplied images through ImageMagick in automated or batch workflows should treat this as elevated priority due to the potential RCE tail risk.

An attacker with the ability to influence CLI arguments passed to an ImageMagick invocation - for example, through a web application that constructs ImageMagick commands incorporating user-supplied parameters, or a batch processing pipeline ingesting attacker-controlled files with embedded artifact metadata - supplies a connected-components:* define containing an out-of-range index. ImageMagick's ConnectedComponentsImage() reads beyond the allocated buffer, causing an access violation that crashes the process or, under suitable memory layout conditions, redirects execution. No public proof-of-concept exploit is known at this time.