QSN-8810-1: ImageMagick vulnerabilities
2026-09-24

Summary:
Several security issues were fixed in ImageMagick.

Details:
It was discovered that ImageMagick did not correctly handle certain
memory operations. An attacker could possibly use this issue to cause
a denial of service. This issue affected Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS
and Ubuntu 24.04 LTS. (CVE-2026-33535)

Kamil Frankowicz discovered that ImageMagick did not correctly handle
certain memory operations. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. This issue affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-33536)

It was discovered that ImageMagick did not correctly handle certain
integer arithmetic. An attacker could possibly use this issue to cause
a denial of service or execute arbitrary code. (CVE-2026-34238)

Jake Lamberson discovered that ImageMagick did not correctly handle
certain memory operations. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. This issue affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-40310)

Junmin Zhu discovered that ImageMagick did not correctly handle certain
memory operations. An attacker could possibly use this issue to cause a
denial of service. This issue affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-40311)

It was discovered that ImageMagick did not correctly handle opening
certain MSL files. If a user or automated system were tricked into
opening a specially crafted file, an attacker could possibly cause a
denial of service. This issue affected Ubuntu 26.04 LTS. (CVE-2026-40312)

It was discovered that ImageMagick did not correctly handle certain
memory operations. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2026-56361)

Affected QuantaStor releases:
  6.9.1.001 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.1.001 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.1.001 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.1.001 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.1.001 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.1.001 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.0.464 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.0.464 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.0.464 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.0.464 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.0.464 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.9.0.464 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.6.015 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.6.015 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.6.015 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.6.015 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.6.015 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.6.015 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.5.018 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.5.018 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.5.018 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.5.018 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.5.018 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.5.018 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.4.038 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.4.038 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.4.038 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.4.038 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.4.038 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.4.038 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.3.018 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.3.018 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.3.018 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.3.018 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.3.018 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.3.018 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.2.002 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.2.002 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.2.002 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.2.002 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.2.002 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.2.002 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.1.007 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.1.007 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.1.007 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.1.007 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.1.007 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.1.007 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.0.205 jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.0.205 jammy: imagemagick-6-common 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.0.205 jammy: imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.0.205 jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.0.205 jammy: libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)
  6.8.0.205 jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm5 (fixed in 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm15)

CVEs: CVE-2026-34238, CVE-2026-40310, CVE-2026-33535, CVE-2026-40312, CVE-2026-56361, CVE-2026-40311, CVE-2026-33536

References:
  https://ubuntu.com/security/notices/USN-8810-1