CVE-2026-56369: ImageMagick

Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days.

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

Affected products

• ImageMagick ImageMagick: before 6.9.13-47 (fixed in 6.9.13-47); from 7.0.0-0, before 7.1.2-22 (fixed in 7.1.2-22)

Published 2026-06-30. Last modified 2026-07-02.