← All notices | Source (USN-8810-1) | Text version
QSN-8810-1: ImageMagick vulnerabilities
September 24, 2026
Summary
Several security issues were fixed in ImageMagick.
Details
It was discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-33535)
Kamil Frankowicz discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-33536)
It was discovered that ImageMagick did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-34238)
Jake Lamberson discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-40310)
Junmin Zhu discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-40311)
It was discovered that ImageMagick did not correctly handle opening certain MSL files. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly cause a denial of service. This issue affected Ubuntu 26.04 LTS. (CVE-2026-40312)
It was discovered that ImageMagick did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-56361)
Affected QuantaStor releases
| Release | Platform | Package | Exposure | Shipped version | Fixed version | Status |
|---|---|---|---|---|---|---|
| 6.9.1.001 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.1.001 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.1.001 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.1.001 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.1.001 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.1.001 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.0.464 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.0.464 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.0.464 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.0.464 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.0.464 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.9.0.464 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.6.015 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.6.015 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.6.015 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.6.015 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.6.015 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.6.015 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.5.018 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.5.018 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.5.018 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.5.018 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.5.018 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.5.018 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.4.038 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.4.038 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.4.038 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.4.038 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.4.038 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.4.038 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.3.018 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.3.018 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.3.018 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.3.018 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.3.018 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.3.018 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.2.002 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.2.002 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.2.002 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.2.002 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.2.002 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.2.002 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.1.007 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.1.007 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.1.007 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.1.007 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.1.007 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.1.007 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.0.205 | Ubuntu 22.04 LTS | imagemagick | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.0.205 | Ubuntu 22.04 LTS | imagemagick-6-common | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.0.205 | Ubuntu 22.04 LTS | imagemagick-6.q16 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.0.205 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.0.205 | Ubuntu 22.04 LTS | libmagickcore-6.q16-6-extra | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
| 6.8.0.205 | Ubuntu 22.04 LTS | libmagickwand-6.q16-6 | Internally-facing | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 | Fix pending |
Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.
CVEs
CVE-2026-34238, CVE-2026-40310, CVE-2026-33535, CVE-2026-40312, CVE-2026-56361, CVE-2026-40311, CVE-2026-33536
References
https://ubuntu.com/security/notices/USN-8810-1
https://nvd.nist.gov/vuln/detail/CVE-2026-34238
https://nvd.nist.gov/vuln/detail/CVE-2026-40310
https://nvd.nist.gov/vuln/detail/CVE-2026-33535
https://nvd.nist.gov/vuln/detail/CVE-2026-40312
https://nvd.nist.gov/vuln/detail/CVE-2026-56361
https://nvd.nist.gov/vuln/detail/CVE-2026-40311
https://nvd.nist.gov/vuln/detail/CVE-2026-33536
Update
Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:
| Platform | Package | Version |
|---|---|---|
| bionic | imagemagick | 8:6.9.7.4+dfsg-16ubuntu6.15+esm17 |
| Ubuntu 20.04 LTS | imagemagick | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm15 |
| Ubuntu 22.04 LTS | imagemagick | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15 |
| Ubuntu 24.04 LTS | imagemagick | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm14 |
| resolute | imagemagick | 8:7.1.2.18+dfsg1-1ubuntu0.1~esm3 |
| trusty | imagemagick | 8:6.7.7.10-6ubuntu3.13+esm26 |
| xenial | imagemagick | 8:6.8.9.9-7ubuntu5.16+esm25 |