CVE-2026-56369

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

Scoring

Severity

MEDIUM

CVSS base score

6.3

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.30%

CWE

CWE-323

Published

2026-06-30

Last modified

2026-07-01

Affected products

• ImageMagick ImageMagick
• ImageMagick ImageMagick
• ImageMagick ImageMagick

Weakness type

• CWE-323

Related vulnerabilities

• CVE-2026-81341 — wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records
• CVE-2026-81020 — wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
• CVE-2026-81019 — wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
• CVE-2026-50577 — ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter
• CVE-2026-17578 — Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement
• CVE-2026-21383 — Reusing a Nonce, Key Pair in Encryption in HLOS
• CVE-2026-59099 — Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure
• CVE-2026-13602 — Session takeover vulnerability

Markdown version · Browse all CVEs