Canonical's Sept 8-10 Ubuntu security sweep: 10 USNs patch at least 17 CVEs across FFmpeg, ImageMagick, glibc, PHP, Python, Netty, Vim, curl and Apache
Relative to the previous story summary, glibc notice USN-8737-2 (CVE-2026-19499 strfmon buffer overflow and CVE-2026-19542 tdelete out-of-bounds access, both potentially DoS or code execution, delivered to Ubuntu 24.04 LTS) is newly merged into this story, while the .NET notice USN-8740-1 (CVE-2026-58649 and CVE-2026-69806) that appeared in the previous summary is not present in the current…
Between September 8 and 10, 2026, Canonical published 10 Ubuntu Security Notices fixing at least 17 CVEs across nine packages, with impacts ranging from denial of service, information disclosure and arbitrary code execution to SQL injection and DNS cache…
Between September 8 and 10, 2026, Canonical issued 10 Ubuntu Security Notices covering nine packages and at least 17 named CVEs. FFmpeg received two notices: USN-8738-1 (Sep 8) fixes CVE-2026-66036 (mishandled video frames in the hqdn3d filter enabling DoS or arbitrary code execution), CVE-2026-66038 (sensitive information disclosure via compressed video files, found by Adrian Junge) and CVE-2026-66039 (DoS or code execution via crafted audio files), plus additional subtitle-file handling flaws; USN-8716-2 (Sep 9) extends the USN-8716-1 fixes to Ubuntu 26.04 LTS for CVE-2026-64830 (VobSub subtitle demuxer), CVE-2026-64831 (Vulkan HEVC hardware decoder) and an NVDEC decoder flaw, all allowing DoS or code execution from crafted media. USN-8739-1 (Sep 8) patches five ImageMagick CVEs: CVE-2026-56366, CVE-2026-56368, CVE-2026-56371 and CVE-2026-56373 (DoS via crafted images on Ubuntu 14.04 through 22.04 LTS) and CVE-2026-56370 (DoS or arbitrary code execution, affecting Ubuntu 22.04 LTS and 26.04 LTS). USN-8737-2 (Sep 10) delivers the earlier USN-8737-1 GNU C Library fixes to Ubuntu 24.04 LTS: CVE-2026-19499, a strfmon buffer overflow via right-justification padding, and CVE-2026-19542, an out-of-bounds stack array access in tdelete, both potentially allowing DoS or code execution. USN-8743-1 (Sep 10) fixes three PHP flaws: CVE-2026-17543 (SQL injection via incorrect backslash escaping in the PostgreSQL extension), CVE-2026-17544 (out-of-bounds write in bccomp(), DoS or code execution on Ubuntu 26.04 LTS) and CVE-2026-7260 (unbounded recursion via circular symlinks in phar archives). USN-8744-1 (Sep 10) addresses CVE-2026-3644 (arbitrary content injection via mishandled control characters in Python's http.cookies) and an unbounded-recursion DoS in the Expat XML parser reached via pyexpat, affecting Ubuntu 14.04 through 24.04 LTS. USN-8742-1 (Sep 10) fixes a Netty flaw in NS-record bailiwick validation that could facilitate DNS cache poisoning. Two notices extend earlier fixes to Ubuntu 26.04 LTS: USN-8679-2 for Vim (Sep 8; crafted tags files could enable arbitrary code execution, with no exploitation reported) and USN-8670-3 for curl (Sep 8; a connection-reuse flaw found by Joshua Rogers that could present the wrong client certificate after certificate settings change — an authentication mix-up rather than code execution). Finally, USN-8571-2 (Sep 10) fixes an Apache HTTP Server regression introduced by USN-8571-1, in which a missing library symbol prevented…
- Canonical published 10 Ubuntu Security Notices between 2026-09-08 and 2026-09-10 covering nine packages and at least 17 named CVEs.
- USN-8738-1 (FFmpeg): CVE-2026-66036 hqdn3d filter DoS or code execution; CVE-2026-66038 information disclosure via compressed video files, found by Adrian Junge; CVE-2026-66039 crafted-audio DoS or code execution; additional subtitle-file…
- USN-8716-2 (FFmpeg, extends USN-8716-1 to Ubuntu 26.04 LTS): CVE-2026-64830 VobSub subtitle demuxer and CVE-2026-64831 Vulkan HEVC hardware decoder, plus an NVDEC decoder flaw — all DoS or arbitrary code execution from crafted media.
- USN-8739-1 (ImageMagick): CVE-2026-56366, CVE-2026-56368, CVE-2026-56371 and CVE-2026-56373 cause DoS via crafted images on Ubuntu 14.04 through 22.04 LTS; CVE-2026-56370 allows DoS or arbitrary code execution on Ubuntu 22.04 LTS and 26.04…
- USN-8737-2 (GNU C Library, extends USN-8737-1 to Ubuntu 24.04 LTS): CVE-2026-19499 strfmon buffer overflow via right-justification padding and CVE-2026-19542 out-of-bounds stack array access in tdelete, both potentially DoS or code…
- USN-8743-1 (PHP): CVE-2026-17543 SQL injection via incorrect backslash escaping in the PostgreSQL extension; CVE-2026-17544 out-of-bounds write in bccomp() (DoS or code execution on Ubuntu 26.04 LTS); CVE-2026-7260 unbounded recursion via…
- USN-8744-1 (Python): CVE-2026-3644 arbitrary content injection via mishandled control characters in http.cookies; unbounded recursion in the Expat XML parser via pyexpat causes DoS; affects Ubuntu 14.04, 16.04, 18.04, 20.04, 22.04 and…
- USN-8742-1 (Netty): NS records are incorrectly validated for bailiwick, which could facilitate DNS cache poisoning attacks.
Coverage
oldest first · one row per article · UTC- · Sep 8, 2026
Ubuntu Security NoticesFirst report
USN-8738-1: FFmpeg vulnerabilities
Ubuntu's USN-8738-1 fixes multiple FFmpeg vulnerabilities allowing denial of service, arbitrary code execution, and sensitive information exposure.
- · Sep 8, 2026
USN-8679-2: Vim vulnerability
Ubuntu's USN-8679-2 updates Vim for Ubuntu 26.04 LTS, fixing a tags-file handling flaw that could allow arbitrary code execution.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-17544+2 related CVEs | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from… | 8.1 group max | <1% | ||
CVE-2026-19499+1 related CVE | Buffer overflow in glibc strfmon() width padding affects glibc 2.38–2.44 | 7.7 group max | — | ||
| CVE-2026-33007 | A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in… | 5.3 | <1% | ||
| CVE-2026-3644 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete | 6.0 | <1% | ||
CVE-2026-56373+1 related CVE | ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails | 6.3 group max | <1% | ||
CVE-2026-56368+1 related CVE | ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed | 6.3 group max | <1% | ||
| CVE-2026-56371 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes | 6.9 | <1% | ||
CVE-2026-69806+1 related CVE | Local Privilege Escalation via Sensitive Information Exposure in Microsoft .NET | 7.0 group max | 2% | ||
CVE-2026-64831+1 related CVE | FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite… | 8.7 | <1% | ||
CVE-2026-66039+2 related CVEs | FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt… | 8.7 group max | <1% |