CVE-2026-41647

Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lxc/incus/releases/tag/v7.0.0	Patch Product
https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Incus es un gestor de contenedores de sistema y máquinas virtuales. Antes de la versión 7.0.0, una falta de manejo de errores podría permitir a un usuario autenticado de Incus provocar una caída del demonio mediante la importación de un archivo de copia de seguridad de un bucket de almacenamiento truncado. Este problema ha sido parcheado en la versión 7.0.0.

Information

Published : 2026-05-07 14:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41647

Mitre link : CVE-2026-41647

CVE.ORG link : CVE-2026-41647

JSON object : View

Products Affected

linuxcontainers

incus

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-41647", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41647", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T13:54:21.594075Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.0.0"}]}]}], "published": "2026-05-07T14:16:03.020", "references": [{"url": "https://github.com/lxc/incus/releases/tag/v7.0.0", "tags": ["Patch", "Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.0.0, una falta de manejo de errores podr\u00eda permitir a un usuario autenticado de Incus provocar una ca\u00edda del demonio mediante la importaci\u00f3n de un archivo de copia de seguridad de un bucket de almacenamiento truncado. Este problema ha sido parcheado en la versi\u00f3n 7.0.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF8EBB4B-C1F0-44C5-B063-9CF8EB6E0972", "versionEndExcluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}