CVE-2026-56369

A vulnerability has been identified in ImageMagick, a software tool used to create, edit, and convert image files. This flaw allows a remote attacker to potentially decrypt and view images that were supposed to be securely encrypted by the software, leading to an unauthorized disclosure of sensitive data.

This Low impact information disclosure flaw in ImageMagick arises from AES-CTR nonce reuse within the PasskeyEncipherImage method. Exploitation requires an attacker to specifically target encrypted images processed by this method, which is not a common default configuration in Red Hat environments. The vulnerability primarily affects applications utilizing the PasskeyEncipherImage function, potentially through bindings like Magick.NET.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this stop using ImageMagick's built-in encryption feature. Rely on standard, OS-level data-at-rest encryption (such as LUKS) to protect sensitive media instead.