← All notices | Source (USN-8772-1) | Text version

QSN-8772-1: AOM vulnerabilities

September 16, 2026

Summary

Several security issues were fixed in AOM.

Details

It was discovered that AOM incorrectly handled the first-pass statistics buffer in Look-Ahead Processing (LAP) mode. An attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or possibly execute arbitrary code. (CVE-2026-56208)

It was discovered that AOM incorrectly validated spatial and temporal layer IDs in the SVC (Scalable Video Coding) encoder controls. An attacker could possibly use this issue to write to an arbitrary memory address, read out-of-bounds heap memory, or execute arbitrary code. (CVE-2026-56209, CVE-2026-56210, CVE-2026-56211)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending
6.9.0.464Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending
6.8.6.015Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending
6.8.5.018Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending
6.8.4.038Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending
6.8.3.018Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending
6.8.2.002Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending
6.8.1.007Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending
6.8.0.205Ubuntu 22.04 LTSlibaom3Internally-facing3.3.0-1ubuntu0.13.3.0-1ubuntu0.1+esm1Fix pending

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-56211, CVE-2026-56210, CVE-2026-56209, CVE-2026-56208

References

https://ubuntu.com/security/notices/USN-8772-1

https://nvd.nist.gov/vuln/detail/CVE-2026-56211

https://nvd.nist.gov/vuln/detail/CVE-2026-56210

https://nvd.nist.gov/vuln/detail/CVE-2026-56209

https://nvd.nist.gov/vuln/detail/CVE-2026-56208

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
Ubuntu 22.04 LTSaom3.3.0-1ubuntu0.1+esm1
Ubuntu 24.04 LTSaom3.8.2-2ubuntu0.2
resoluteaom3.13.1-2ubuntu0.1