Ubuntu USN-8859-1 Fixes ImageMagick Vulnerabilities
Tech GuruQuick Answer
USN-8859-1 fixes six ImageMagick vulnerabilities with release-dependent denial-of-service and information-disclosure risks. Update the binaries used by the real image-processing application, including its libraries, rather than checking only a command-line version. All builds listed in this notice use Ubuntu Pro ESM or Legacy Support channels, including Ubuntu 26.04; confirm access to the matching repository before treating a routine update as remediation.
Confirm Scope And Apply The Supported Fix
What to do now: Prioritize upload conversion, thumbnail and batch-image workers that process outside files. Identify their ImageMagick package origin, Core/Wand libraries and language bindings. Update installed dependencies from the matching channel, restart affected workers and assess container or bundled copies separately.
Last verified: 2026-10-02 UTC against USN-8859-1 JSON, including CVE scope and binary-package delivery channels.
Scope And Authority
| Product scope | ImageMagick vulnerabilities on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty) |
|---|---|
| Advisory | USN-8859-1 |
| CVEs | CVE-2026-56367, CVE-2026-93586, CVE-2026-93587, CVE-2026-93588, CVE-2026-93589, CVE-2026-93590 |
| Authoritative release date | 2026-09-30 16:39:48.363226 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8859-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty). |
| Fixed version | Selected runtime binaries; update those installed and their required dependencies. The linked USN has the full package list: bionic: imagemagick 8:6.9.7.4+dfsg-16ubuntu6.15+esm18 (esm-infra)bionic: libmagickcore-6.q16-3 8:6.9.7.4+dfsg-16ubuntu6.15+esm18 (esm-infra)bionic: libmagickwand-6.q16-3 8:6.9.7.4+dfsg-16ubuntu6.15+esm18 (esm-infra)focal: imagemagick 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16 (esm-apps)focal: libmagickcore-6.q16-6 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16 (esm-apps)focal: libmagickwand-6.q16-6 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16 (esm-apps)jammy: imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16 (esm-apps)jammy: libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16 (esm-apps)jammy: libmagickwand-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16 (esm-apps)noble: imagemagick 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15 (esm-apps)noble: libmagickcore-6.q16-7t64 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15 (esm-apps)noble: libmagickwand-6.q16-7t64 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15 (esm-apps)resolute: imagemagick 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4 (esm-apps)resolute: libmagickcore-7.q16-10 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4 (esm-apps)resolute: libmagickwand-7.q16-10 8:7.1.2.18+dfsg1-1ubuntu0.1~esm4 (esm-apps)trusty: imagemagick 8:6.7.7.10-6ubuntu3.13+esm27 (esm-infra-legacy)trusty: libmagickcore5 8:6.7.7.10-6ubuntu3.13+esm27 (esm-infra-legacy)trusty: libmagickwand5 8:6.7.7.10-6ubuntu3.13+esm27 (esm-infra-legacy)xenial: imagemagick 8:6.8.9.9-7ubuntu5.16+esm26 (esm-infra-legacy)xenial: libmagickcore-6.q16-2 8:6.8.9.9-7ubuntu5.16+esm26 (esm-infra-legacy)xenial: libmagickwand-6.q16-2 8:6.8.9.9-7ubuntu5.16+esm26 (esm-infra-legacy) |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Canonical limits CVE-2026-56367's denial-of-service/information-disclosure issue to Ubuntu 16.04 through 24.04. CVE-2026-93587 and CVE-2026-93588 concern local denial of service on 20.04 through 26.04. CVE-2026-93589 applies to 18.04 through 26.04, and CVE-2026-93590 only to 26.04. CVE-2026-93586 has no narrower release qualification in the notice. These are not six interchangeable attack paths, and the notice does not claim arbitrary code execution.
What To Validate Now
- Identify the actual decoder. Trace the image-processing route to its command, library or language binding and package origin. Account for multiple ImageMagick versions, HDRI variants and application bundles; the selected runtime names above are not an instruction to install a new variant.
- Confirm the delivery channel. Ubuntu 20.04-26.04 use the listed ESM Apps builds, 18.04 uses ESM Infra, and 14.04/16.04 use Legacy Support. Verify entitlement and repository availability rather than assuming a supported LTS label implies this package fix is available without Pro.
- Update the installed dependency set. Use the full USN package list for additional Core/Wand, C++, Perl or HDRI packages already in use. Apply the matching versions, drain queued jobs where necessary and restart long-running consumers so they load the new libraries.
- Exercise the production route with benign files. Process representative authorized images and verify dimensions, expected format, output and failure handling. Keep existing resource, decoder and delegate restrictions; do not disable processing policy to force a test to pass.
- Retain bounded results. Record binary versions, application/runtime identity, worker restart and benign test outcomes. Use non-sensitive test images and retain existing recovery settings; a successful thumbnail does not establish every CVE's reachability or absence of earlier disclosure.
Operational Cautions
Keep the release-specific CVE conditions and package variants separate. An Ubuntu package update does not patch a library embedded in an unrelated application or image. The notice does not state exploitation, and no decoder or service test was performed here. Restrict untrusted input and processing privileges while unresolved updates or compatibility failures are addressed.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
