- CVE-2026-56361: out-of-bounds access in AcquireKernelBuiltIn() (magick/morphology.c) from an off-by-one in the user-kernel origin bounds check, which accepted xi/psi equal to the kernel width or height - CVE-2026-56367: integer overflow of image->rows * psd_info->channels in the PSD RLE reader (coders/psd.c ReadPSDMergedImage) leading to an undersized allocation and heap out-of-bounds access on the 32-bit (i686) build - CVE-2026-56368: memory leak of the acquired QuantumInfo in the raw-pixel writers (coders/bgr.c, cmyk.c, gray.c, rgb.c, ycbcr.c) when OpenBlob() fails and Write*Image returns early - CVE-2026-56370: out-of-bounds write in ConnectedComponentsImage() (magick/vision.c) where a user connected-components:keep/remove id indexes the object array without a range check - CVE-2026-56378: out-of-bounds write in the PCD Huffman decoder DecodeImage() (coders/pcd.c) where crafted input advances the output pointer past the end of the luma buffer