Out-of-Bounds Vulnerability in Incus System Container and VM Manager

CVE-2026-40251

What is CVE-2026-40251?

Incus, a system container and virtual machine manager, is impacted by an out-of-bounds access vulnerability present in versions prior to 7.0.0. This vulnerability arises from missing validation logic in the storage volume import feature, allowing an authenticated user to trigger crashes in the Incus daemon. Specifically, the backup restore subsystem is susceptible to an out-of-bounds panic when indexing snapshot metadata arrays due to incorrect bounds checking. An attacker can exploit this issue by submitting a backup archive containing tampered metadata, which can lead to the daemon being unable to recover from the invalid access. Consequently, this can result in a denial of service, preventing the normal operation of Incus. The vulnerability has been addressed in version 7.0.0.

References