Impex release information
Release Type: Hotfix
Release date: 2026-11-06
The IMPEX 6.3.1 release
This release is a hotfix that should prevent the USBProtect station hangs seen at some customers. The hangs happen during the night to Monday. We have not been able to reproduce it on Gen2 hardware but have seen this happen on a Gen3 POC system. At the same time we add more NVMe disk log collection in case this does not stop the hangs.
We also add a patch for a regression in the support of vfat BitLocker drives and UTF-8 characters. NTFS and exFAT BitLocker drives were not affected.
USBProtect changes
- Recent releases had a regression where BitLocker drives with vfat (FAT32) filesystems got mounted without UTF-8 support. This has now been fixed. This did not affect BitLocker drives with NTFS or exFAT.
- Disable the operating system’s fstrim service, which is suspected of triggering a problem in the kernel’s NVMe handling or in the disk firmware that makes stations hang.
- Enable more NVMe info collection in the nightly logs for future forensics if hangs continue to happen.
Security related
- BitLocker drives are now mounted with the same restrictions as other USB drives: no device files, no setuid programs and no running programs from the drive.
- brotli packages have been updated to fix CVE-2026-111497. Impex products do not use brotli anywhere so there is no attack surface in them.
- chromium has been updated to 156.0.8078.79 to fix CVE-2026-76024 to CVE-2026-76031, CVE-2026-110913 to CVE-2026-110922, CVE-2026-112992 to CVE-2026-112994, CVE-2026-112996 to CVE-2026-113000, CVE-2026-113002 to CVE-2026-113005, CVE-2026-113008, CVE-2026-113011, CVE-2026-113012, CVE-2026-113018 to CVE-2026-113020, CVE-2026-113022, CVE-2026-113026, CVE-2026-113033 to CVE-2026-113035, CVE-2026-113040, CVE-2026-113344, CVE-2026-118304 to CVE-2026-118322, CVE-2026-118327 to CVE-2026-118359 and CVE-2026-119260 to CVE-2026-119272.
- ghostscript has been updated to 10.06.0 to fix CVE-2026-39919, CVE-2026-101258 and CVE-2026-103226.
- glib-networking has been updated to 2.80.1 to fix CVE-2026-103963.
- libsoup3 has been updated to 3.6.6 to fix CVE-2026-3099, CVE-2026-3632 to CVE-2026-3634, CVE-2026-85197, CVE-2026-85534, CVE-2026-102555 to CVE-2026-102560 and CVE-2026-103399.
- python3-pillow has been updated to 12.3.0 to fix CVE-2026-112393, CVE-2026-112398, CVE-2026-112892 and CVE-2026-112900.
- python3.14 has been updated to 3.14.10 to fix CVE-2026-12345.
- util-linux has been updated to 2.41.6 to fix CVE-2026-27456 and CVE-2026-76642.
- unbound has been updated to 1.26.2 to fix CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.
Information
Operating system packages
All system components have been updated to their latest respective version.
Online Documentation
Further details and configuration guidance are available in the official documentation:
https://sysctl.se/impex/documentation/
SBOM
Each ISO and VHD release has a software bill of materials (SBOM) to make introspection of the release easy to integrate with a number of security tools. Current and historical SBOMs are available for download at the customer portal.
Update Instructions
For networked Impex stations, this release will be automatically installed as part of the regular update process. No manual steps are required from administrators or users. The system will apply the update seamlessly in the background, ensuring that the latest fixes are in place without any interruption to normal operations.
For standalone Impex stations, your organisation needs to download the update from portal.sysctl.se in accordance with the update instructions in the chapter “USBProtect in offline mode” in the Impex USB Protect user manual.
Links
Sysctl web page
https://www.sysctl.se
Sysctl page for Impex releases
https://sysctl.se/impex/releases/
Sysctl documentation for Impex
https://sysctl.se/impex/documentation/
Sysctl customer portal
Sysctl rss/atom