CVE-2026-56369: ImageMagick Information Disclosure Flaw

CVE-2026-56369 Overview

CVE-2026-56369 is an information disclosure vulnerability in ImageMagick versions before 7.1.2-22. The flaw resides in the PasskeyEncipherImage method, which reuses the Advanced Encryption Standard Counter (AES-CTR) nonce across multiple encryption operations. Attackers who obtain multiple ciphertexts encrypted under the same key can exploit this cryptographic weakness to recover plaintext content from encrypted images. The issue is tracked under [CWE-323] (Reusing a Nonce, Key Pair in Encryption). ImageMagick is a widely deployed image processing library used in server-side web applications, content pipelines, and scientific imaging tools.

Critical Impact
Nonce reuse in AES-CTR mode allows attackers to XOR ciphertexts and recover plaintext image data without knowing the encryption key.

Affected Products

ImageMagick versions prior to 7.1.2-22
Applications embedding ImageMagick's PasskeyEncipherImage method
Server-side image processing pipelines invoking passkey-based encipherment

Discovery Timeline

2026-06-30 - CVE-2026-56369 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-56369

Vulnerability Analysis

The vulnerability originates in ImageMagick's PasskeyEncipherImage function, which uses AES in Counter (CTR) mode to encrypt image data with a user-supplied passkey. AES-CTR requires that the nonce (also called the initialization vector) be unique for every encryption performed with the same key. The affected implementation fails to generate or persist a fresh nonce per invocation, resulting in nonce reuse across multiple encrypted outputs.

When two ciphertexts are produced using the same key and nonce, an attacker can XOR the ciphertexts together to eliminate the keystream. The result is the XOR of the two plaintexts, which reveals structural information and often enough content to reconstruct portions of the original images. For image data, which contains predictable headers, palette metadata, and repeating pixel patterns, this reconstruction is particularly effective.

Root Cause

The root cause is improper cryptographic nonce management inside PasskeyEncipherImage. The implementation derives or fixes the AES-CTR counter in a manner that produces identical keystreams for a given passkey. This violates the fundamental uniqueness requirement of stream cipher modes and constitutes a classic [CWE-323] weakness.

Attack Vector

Exploitation is network-reachable when ImageMagick is exposed through a web service, upload handler, or automated processing pipeline. The attacker must obtain at least two ciphertexts produced with the same passkey. Because no authentication is required and user interaction is not needed, adversaries who can submit content or retrieve encrypted images from a shared processing service can perform ciphertext-only attacks. Attack complexity is elevated because the attacker must gather multiple ciphertexts encrypted under the same key.

The vulnerability manifests inside the passkey-based encipherment routine. See the GitHub Security Advisory GHSA-qv2q-c278-pch5 and the VulnCheck Advisory on ImageMagick for technical details.

Detection Methods for CVE-2026-56369

Indicators of Compromise

Presence of ImageMagick binaries or libraries reporting versions earlier than 7.1.2-22 in software inventories.
Repeated invocations of PasskeyEncipherImage or the -encipher command-line option against multiple images with the same passkey.
Encrypted image artifacts produced by vulnerable ImageMagick versions stored in shared object storage or backup repositories.

Detection Strategies

Inventory ImageMagick installations across containers, build agents, and web servers, and flag versions below 7.1.2-22.
Perform static analysis on application code to identify calls to PasskeyEncipherImage or CLI usage of -encipher and confirm nonce handling.
Review web server and application logs for image upload endpoints that pipe user-supplied data through ImageMagick encipherment workflows.

Monitoring Recommendations

Instrument image processing services to log passkey-based encryption operations and verify that unique nonces are generated per operation after patching.
Monitor package management events for installation or downgrade of ImageMagick to affected versions.
Track access patterns to storage locations containing encrypted image outputs to detect bulk retrieval attempts consistent with ciphertext-collection attacks.

How to Mitigate CVE-2026-56369

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-22 or later on all systems, including container base images and CI/CD build environments.
Rotate any passkeys previously used with PasskeyEncipherImage and re-encrypt sensitive image data using patched builds.
Treat previously produced ciphertexts as potentially compromised and remove them from publicly reachable storage.

Patch Information

The ImageMagick project addressed the nonce reuse in the PasskeyEncipherImage implementation in release 7.1.2-22. Details are provided in the GitHub Security Advisory GHSA-qv2q-c278-pch5. Distribution maintainers should track backported fixes in their respective package channels.

Workarounds

Disable use of PasskeyEncipherImage and the -encipher command-line functionality until upgrades are complete.
Replace ImageMagick-based image encryption with a vetted cryptographic library that enforces unique nonces per operation, such as libsodium's authenticated encryption primitives.
Restrict network exposure of image processing endpoints and require authentication to limit the ability of external attackers to collect ciphertexts.

bash

# Verify installed ImageMagick version and upgrade
magick -version | head -n1

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade imagemagick

# RHEL/Fedora
sudo dnf upgrade ImageMagick

# Confirm fixed version 7.1.2-22 or later is installed
magick -version | grep -Eo 'ImageMagick [0-9.\-]+'