{"id":"EUVD-2026-40449","enisaUuid":"17033a43-93b2-395c-adb3-e95157aabdcb","description":"ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.","datePublished":"Jun 30, 2026, 10:08:38 PM","dateUpdated":"Oct 29, 2026, 9:15:53 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qv2q-c278-pch5\nhttps://www.vulncheck.com/advisories/imagemagick-information-disclosure-via-aes-ctr-nonce-reuse-in-passkeyencipherimage\n","aliases":"CVE-2026-56369\nGHSA-vgqj-4jhr-3wh5\n","assigner":"VulnCheck","epss":0.23,"enisaIdProduct":[{"id":"13e8c23b-42ca-3081-b074-6124e4b57d4a","product":{"name":"ImageMagick","vendor":{"name":"ImageMagick"}},"product_version":"7.0.0 \u003c7.1.2-22"},{"id":"5efb8934-d231-3b29-8328-7afd28abfa9d","product":{"name":"ImageMagick","vendor":{"name":"ImageMagick"}},"product_version":"0 \u003c6.9.13-47"}],"enisaIdVendor":[{"id":"d0b2d4dc-aec4-3bfb-b271-aaf12dc79112","vendor":{"name":"ImageMagick"}}],"enisaIdVulnerability":[{"id":"3404db01-3bb1-356f-a1cf-94310d30df9a","vulnerability":{"id":"CVE-2026-56369","description":"ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.","datePublished":"Jun 30, 2026, 10:08:38 PM","dateUpdated":"Oct 29, 2026, 9:15:53 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qv2q-c278-pch5\nhttps://www.vulncheck.com/advisories/imagemagick-information-disclosure-via-aes-ctr-nonce-reuse-in-passkeyencipherimage\n","enisa_id":"EUVD-2026-40449\n","assigner":"VulnCheck","epss":0.23,"dataProcessed":"Nov 3, 2026, 7:17:08 AM","vulnerabilityProduct":[{"id":"4bcd5dd1-a3e5-3a0f-81a4-92b98327db7b","product":{"name":"ImageMagick","vendor":{"name":"ImageMagick"}},"product_version":"7.0.0 \u003c7.1.2-22"},{"id":"bbbfba04-81cf-3fa1-80d2-b4d057695aee","product":{"name":"ImageMagick","vendor":{"name":"ImageMagick"}},"product_version":"0 \u003c6.9.13-47"}],"vulnerabilityVendor":[{"id":"4b2520af-5f3f-3118-813e-cff3f1e17858","vendor":{"name":"ImageMagick"}}]}},{"id":"b36e0eec-eb7e-34e4-a7e7-312085db37f4","vulnerability":{"id":"GHSA-vgqj-4jhr-3wh5","description":"ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.","datePublished":"Jul 1, 2026, 12:34:14 AM","dateUpdated":"Jul 1, 2026, 12:34:14 AM","baseScore":0.0,"references":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qv2q-c278-pch5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56369\nhttps://www.vulncheck.com/advisories/imagemagick-information-disclosure-via-aes-ctr-nonce-reuse-in-passkeyencipherimage\n","enisa_id":"EUVD-2026-40449\n","aliases":"GHSA-vgqj-4jhr-3wh5\nCVE-2026-56369\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}