CVE-2026-56369 · Symaro Security Advisory

Description

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

Severity (CVSS)

Base score	6.3
Severity	Medium
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-323 — Reusing a Nonce, Key Pair in Encryption

Affected products

Vendor	Product	Versions
ImageMagick	ImageMagick	0 to <7.1.2-22; 7.1.2-22
ImageMagick	ImageMagick	0 to <6.9.13-47; 6.9.13-47

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qv2q-c278-pch5 (vendor-advisory)
https://www.vulncheck.com/advisories/imagemagick-information-disclosure-via-aes-ctr-nonce-reuse-in-passkeyencipherimage (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 01 Jul 2026 07:05 UTC.