{"id":"EUVD-2026-28371","enisaUuid":"64b99a1e-5f5a-32c9-a0d0-0af14a9147e2","description":"Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.","datePublished":"May 7, 2026, 1:02:15 PM","dateUpdated":"May 7, 2026, 1:54:39 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m\nhttps://github.com/lxc/incus/releases/tag/v7.0.0\n","aliases":"CVE-2026-41647\nGHSA-fwj8-62r8-8p8m\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"784f5df9-fc28-36cf-82fd-cb98324cdc78","product":{"name":"incus","vendor":{"name":"lxc"}},"product_version":"\u003c 7.0.0"}],"enisaIdVendor":[{"id":"08b21e58-2e1c-3a2b-abce-7ca763c3f5af","vendor":{"name":"lxc"}}],"enisaIdVulnerability":[{"id":"0744cc8b-765b-34a0-9fee-8b4112ef515c","vulnerability":{"id":"GHSA-fwj8-62r8-8p8m","description":"Incus has Nil-Pointer Dereference via S3 Bucket Import","datePublished":"May 4, 2026, 7:38:48 PM","dateUpdated":"May 8, 2026, 9:47:04 PM","baseScore":0.0,"references":"https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41647\nhttps://github.com/lxc/incus\nhttps://github.com/lxc/incus/releases/tag/v7.0.0\n","enisa_id":"EUVD-2026-28371\n","aliases":"CVE-2026-41647\nGHSA-fwj8-62r8-8p8m\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7d7aeab7-54cd-375d-a979-1a3b4cace080","vulnerability":{"id":"CVE-2026-41647","description":"Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.","datePublished":"May 7, 2026, 1:02:15 PM","dateUpdated":"May 7, 2026, 1:54:39 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m\nhttps://github.com/lxc/incus/releases/tag/v7.0.0\n","enisa_id":"EUVD-2026-28371\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"b9c6171b-55d9-3e19-90e7-2c8366e6cf51","product":{"name":"incus","vendor":{"name":"lxc"}},"product_version":"\u003c 7.0.0"}],"vulnerabilityVendor":[{"id":"721b5c63-a4dc-37bf-b795-18b5950993a0","vendor":{"name":"lxc"}}]}}],"enisaIdAdvisory":[]}