Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-30T22:08:38 ImageMagick: ImageMagick: Information disclosure due to AES-CTR nonce reuse 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-323

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

A vulnerability has been identified in ImageMagick, a software tool used to create, edit, and convert image files. This flaw allows a remote attacker to potentially decrypt and view images that were supposed to be securely encrypted by the software, leading to an unauthorized disclosure of sensitive data.

This Low impact information disclosure flaw in ImageMagick arises from AES-CTR nonce reuse within the `PasskeyEncipherImage` method. Exploitation requires an attacker to specifically target encrypted images processed by this method, which is not a common default configuration in Red Hat environments. The vulnerability primarily affects applications utilizing the `PasskeyEncipherImage` function, potentially through bindings like Magick.NET. To mitigate this stop using ImageMagick's built-in encryption feature. Rely on standard, OS-level data-at-rest encryption (such as LUKS) to protect sensitive media instead. Red Hat Enterprise Linux 6 Out of support scope ImageMagick Red Hat Enterprise Linux 7 Out of support scope ImageMagick https://www.cve.org/CVERecord?id=CVE-2026-56369 https://nvd.nist.gov/vuln/detail/CVE-2026-56369 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qv2q-c278-pch5 https://www.vulncheck.com/advisories/imagemagick-information-disclosure-via-aes-ctr-nonce-reuse-in-passkeyencipherimage