Executive brief
ImageMagick is a software suite used for editing and converting digital images. A vulnerability in its encryption component could allow an attacker to potentially recover sensitive information from encrypted images due to a technical error in how the encryption keys are handled. This could lead to the unauthorized disclosure of data that was intended to be protected.
Technical details
The vulnerability exists in the PasskeyEncipherImage method of ImageMagick (specifically affecting Magick.NET wrappers) due to the reuse of nonces in AES-CTR mode (CWE-323). AES-CTR requires a unique nonce for every encryption operation with the same key; reusing a nonce allows an attacker to perform a XOR operation between two ciphertexts to reveal information about the underlying plaintexts. The root cause is the use of insufficiently random or static values in a security context (CWE-330). Exploitation requires a network-based attacker to have access to multiple images encrypted with the same parameters. The issue is addressed in Magick.NET version 14.12.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.12.0
- ImageMagick,versions: Magick.NET-Q16-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-x86 < 14.12.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-x86 < 14.12.0
Timeline
- 2026-05-16: disclosed
- 2026-05-21: advisory: GHSA-qv2q-c278-pch5 published
- 2026-05-21: patched