GHSA-qv2q-c278-pch5: ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse

May 21, 2026

The PasskeyEncipherImage method is vulnerable to information disclosure via AES-CTR nonce reuse. ImageMagick has update the documentation on its website to make it more clear that this is happening: https://imagemagick.org/cipher/

References

github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qv2q-c278-pch5
github.com/advisories/GHSA-qv2q-c278-pch5
imagemagick.org/cipher

Code Behaviors & Features

Detect and mitigate GHSA-qv2q-c278-pch5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →