USN-8739-1: ImageMagick vulnerabilities
Canonical released USN-8739-1 fixing five ImageMagick flaws that could cause denial of service or arbitrary code execution.
Ubuntu security notice USN-8739-1 patches five ImageMagick vulnerabilities: CVE-2026-56366, CVE-2026-56368, CVE-2026-56371, and CVE-2026-56373 allow denial of service via crafted images on Ubuntu 14.04 through 22.04 LTS. CVE-2026-56370 affects Ubuntu 22.04 LTS and 26.04 LTS and could allow denial of service or arbitrary code execution. Users should apply the updated ImageMagick packages to affected releases.
- Five ImageMagick CVEs fixed, including CVE-2026-56370 allowing arbitrary code execution
- DoS-only flaws affect Ubuntu 14.04 LTS through 22.04 LTS
- Code execution flaw affects Ubuntu 22.04 LTS and 26.04 LTS
- Patches available through Ubuntu package updates
- Vendors
- CanonicalImageMagick
- Products
- UbuntuImageMagick
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-56373+1 related CVE | ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails | 6.3 group max | <1% | ||
CVE-2026-56368+1 related CVE | ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed | 6.3 group max | <1% | ||
| CVE-2026-56371 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes | 6.9 | <1% |
From the original article
It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.