CVE-2026-56369

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56369

EUVD

EUVD-2026-40449

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 7.1.2-22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-323	Nonces should be used for the present occasion and only once.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick versions before 7.1.2-22 and involves the PasskeyEncipherImage method. It is caused by the reuse of the AES-CTR nonce, which is a critical component in the encryption process.

Because the nonce is reused in the cipher implementation, attackers can exploit this flaw to recover plaintext information from images that are supposed to be encrypted, leading to information disclosure.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information contained within encrypted images processed by vulnerable versions of ImageMagick.

Attackers exploiting the nonce reuse can recover plaintext data, potentially exposing confidential or private information that was intended to be protected by encryption.

Hi! I’m here to help you understand CVE-2026-56369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70