The vulnerability is an improper handling of cryptographic parameters in ImageMagick versions prior to 7.1.2-22. The PasskeyEncipherImage routine reuses the AES-CTR nonce when decrypting images, which allows an attacker to recover XOR‑masked plaintext from the ciphertext using standard nonce‑reuse cryptanalysis. This results in disclosure of hidden or embedded data that the image is meant to protect, exposing potentially confidential information to anyone who can obtain the encrypted image. The weakness maps to CWE‑323, Improper Validation or Handling of Cryptographic Keys.

ImageMagick installation is affected. Any version earlier than 7.1.2‑22 is vulnerable. The vulnerability is present in all distribution packages that include the PasskeyEncipherImage method, typically embedded in the core library used by image processing applications.

The CVSS score of 6.3 indicates a moderate severity, primarily due to the lack of a direct remote code execution path. Exploitation requires the attacker to supply or influence the choice of an encrypted image processed by the vulnerable routine. Because the flaw leverages nonce reuse, once the image is processed, the attacker can recover plaintext without further interaction. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that no widespread active exploitation has been documented. Nonetheless, the potential for sensitive data leakage warrants prompt remediation.