Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
ImageMagick: Information Disclosure via AES Nonce Reuse
published 5 months ago
Summary
ImageMagick, a popular image processing tool, is vulnerable to information disclosure when using its encryption features. This means that sensitive information could potentially be exposed. To mitigate this risk, users should update to the latest version of ImageMagick and review its documentation on encryption usage.
What to do
- Update dirk lemstra magick.net-q16-hdri-anycpu to version 14.12.0.
- Update dirk lemstra magick.net-q16-anycpu to version 14.12.0.
- Update dirk lemstra magick.net-q8-x86 to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-openmp-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-openmp-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q8-openmp-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-x86 to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-x86 to version 14.12.0.
- Update dirk lemstra magick.net-q8-openmp-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q8-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q8-anycpu to version 14.12.0.
- Update dirk lemstra magick.net-q16-hdri-arm64 to version 14.12.0.
- Update dirk lemstra magick.net-q16-openmp-x64 to version 14.12.0.
- Update dirk lemstra magick.net-q8-arm64 to version 14.12.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| NuGet | dirk lemstra | magick.net-q16-hdri-anycpu |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-anycpu |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q8-x86 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-hdri-openmp-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-openmp-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q8-openmp-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-hdri-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-x86 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-hdri-x86 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q8-openmp-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q8-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q8-anycpu |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-hdri-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q16-openmp-x64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
| NuGet | dirk lemstra | magick.net-q8-arm64 |
< 14.12.0 Fix: upgrade to 14.12.0
|
Original advisory text
ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse
The PasskeyEncipherImage method is vulnerable to information disclosure via AES-CTR nonce reuse. ImageMagick has update the documentation on its website to make it more clear that this is happening: https://imagemagick.org/cipher/
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-323Reusing a Nonce, Key Pair in Encryption
CWE-330Use of Insufficiently Random Values
Timeline
Published21 May 2026
Updated21 May 2026
First seen21 May 2026
Sources
GHSA-qv2q-c278-pch5 · OSV
Track software like this
Free during beta