{"id":"EUVD-2026-63974","enisaUuid":"3478947b-ffb5-3666-81c5-134ef5254eab","description":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s \u003d\u003d nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.","datePublished":"Aug 21, 2026, 2:10:34 PM","dateUpdated":"Aug 21, 2026, 9:44:23 PM","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://github.com/lxc/incus/security/advisories/GHSA-xhqx-mgh3-3h7q\n","aliases":"CVE-2026-48756\nGHSA-xhqx-mgh3-3h7q\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"bd34ec08-a2c4-3eb9-a891-5ceed2620f64","product":{"name":"incus","vendor":{"name":"lxc"}},"product_version":"\u003c 7.1.0"}],"enisaIdVendor":[{"id":"e1c04aca-1177-306c-b31f-2a3fdf6e1a57","vendor":{"name":"lxc"}}],"enisaIdVulnerability":[{"id":"1db6d488-4447-3462-859a-bc513702ecfe","vulnerability":{"id":"GHSA-xhqx-mgh3-3h7q","description":"Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)","datePublished":"Jun 26, 2026, 7:07:54 PM","dateUpdated":"Jun 26, 2026, 7:07:54 PM","baseScore":0.0,"references":"https://github.com/lxc/incus/security/advisories/GHSA-xhqx-mgh3-3h7q\nhttps://github.com/lxc/incus\n","enisa_id":"EUVD-2026-63974\n","aliases":"GHSA-xhqx-mgh3-3h7q\nCVE-2026-48756\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5634c1b1-24a8-3b9f-a0f7-e97d9b6f6834","vulnerability":{"id":"CVE-2026-48756","description":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s \u003d\u003d nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.","datePublished":"Aug 21, 2026, 2:10:34 PM","dateUpdated":"Aug 21, 2026, 9:44:23 PM","status":"PUBLISHED","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://github.com/lxc/incus/security/advisories/GHSA-xhqx-mgh3-3h7q\n","enisa_id":"EUVD-2026-63974\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"4e7c234c-c340-3c04-8f05-eb7020216502","product":{"name":"incus","vendor":{"name":"lxc"}},"product_version":"\u003c 7.1.0"}],"vulnerabilityVendor":[{"id":"30572b50-9a9b-3e79-80e1-7a5876625b30","vendor":{"name":"lxc"}}]}}],"enisaIdAdvisory":[{"id":"46a9890b-a787-3aec-b551-c3db6b3832e9","advisory":{"id":"openSUSE-SU-2026:11651-1","description":"incus-7.4-1.1 on GA media","summary":"incus-7.4-1.1 on GA media","datePublished":"Aug 31, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:22:13 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11651-1.json\nhttps://www.suse.com/security/cve/CVE-2026-39402/\nhttps://www.suse.com/security/cve/CVE-2026-47753/\nhttps://www.suse.com/security/cve/CVE-2026-48749/\nhttps://www.suse.com/security/cve/CVE-2026-48750/\nhttps://www.suse.com/security/cve/CVE-2026-48751/\nhttps://www.suse.com/security/cve/CVE-2026-48752/\nhttps://www.suse.com/security/cve/CVE-2026-48753/\nhttps://www.suse.com/security/cve/CVE-2026-48754/\nhttps://www.suse.com/security/cve/CVE-2026-48755/\nhttps://www.suse.com/security/cve/CVE-2026-48756/\nhttps://www.suse.com/security/cve/CVE-2026-48769/\nhttps://www.suse.com/security/cve/CVE-2026-55621/\nhttps://www.suse.com/security/cve/CVE-2026-55622/\nhttps://www.suse.com/security/cve/CVE-2026-62313/\nhttps://www.suse.com/security/cve/CVE-2026-62867/\nhttps://www.suse.com/security/cve/CVE-2026-62940/\nhttps://www.suse.com/security/cve/CVE-2026-62941/\nhttps://www.suse.com/security/cve/CVE-2026-63125/\nhttps://www.suse.com/security/cve/CVE-2026-63343/\nhttps://www.suse.com/security/cve/CVE-2026-81500/\nhttps://www.suse.com/security/cve/CVE-2026-81501/\n","aliases":"CVE-2026-39402\nCVE-2026-47753\nCVE-2026-48749\nCVE-2026-48750\nCVE-2026-48751\nCVE-2026-48752\nCVE-2026-48753\nCVE-2026-48754\nCVE-2026-48755\nCVE-2026-48756\nCVE-2026-48769\nCVE-2026-55621\nCVE-2026-55622\nCVE-2026-62313\nCVE-2026-62867\nCVE-2026-62940\nCVE-2026-62941\nCVE-2026-63125\nCVE-2026-63343\nCVE-2026-81500\nCVE-2026-81501\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"03a17789-c710-3b17-9460-16163591d93f","product":{"name":"incus-tools-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"0437571b-35b8-3eec-b808-726d5ffcde2a","product":{"name":"incus-cli-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"055e79ea-486e-3c05-98f8-35197166b6cd","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"06b12a41-b007-3090-86c7-5aa3eec20eb8","product":{"name":"incus-tools-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"29c90d22-e153-3fc3-95b8-6edc33a33b76","product":{"name":"incus-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"31c4580e-6ad3-39d6-b665-224d84287177","product":{"name":"incus-cli-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4b7a8928-b8aa-3773-855c-6880bbaab457","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"667eafc2-5107-3083-a29c-2ea312423cf1","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"71c4e5a6-7c79-3f6a-a670-efce312e7775","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"778ffed4-fd86-3888-b1e8-a91cd0e5294d","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7b39a356-718a-37e2-aac4-2cbf349d558a","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8b05d619-a1a8-367d-a706-17664db33693","product":{"name":"incus-cli-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8ef511e4-900c-3ea5-ae04-0fe047a8f63a","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"913203f9-c901-3c34-96f8-6db1c564151b","product":{"name":"incus-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"91c03075-af87-36f2-b8e9-7d5f1533aacb","product":{"name":"incus-tools-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ab6ccc6f-660c-3880-a05d-e3b68a5c840c","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b387857e-6a7f-352b-8810-2d1b348e32ff","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b6aaa0fd-1fd8-3d86-9f40-80729614d3f1","product":{"name":"incus-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c302e38c-fd12-30d4-95da-5c80bb3bf690","product":{"name":"incus-tools-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c489ed71-3ab8-3693-aaa1-93d441cc0989","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c54ff042-297e-3f89-b844-7b1cfc0ed49a","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cc244842-7b65-38ef-bd3a-d42275a18afb","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ce48a0e4-a973-3859-9948-b6b45721d92b","product":{"name":"incus-cli-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"d09dcf9a-9015-3724-8cda-13a869b8c222","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"de406327-2ca1-3139-8d56-ce19454d34a0","product":{"name":"incus-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}