GHSA-qv2q-c278-pch5

ghsaUSosv

ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse

view advisory published 2026-05-21Licence: CC-BY-4.0

The PasskeyEncipherImage method is vulnerable to information disclosure via AES-CTR nonce reuse. ImageMagick has update the documentation on its website to make it more clear that this is happening: https://imagemagick.org/cipher/

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-56369US	—OT elevated	0.23% (14th)	—	2026-06-30
ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the…

references

External citations — patches, advisories, analysis.

https://github.com/ImageMagick/ImageMagickPACKAGE
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qv2q-c278-pch5WEB
https://imagemagick.org/cipherWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan