CVE-2026-62867

Aliases:UBUNTU-CVE-2026-62867DEBIAN-CVE-2026-62867
PUBLISHED
Published: 21 Aug 2026, 14:45
Last modified:21 Aug 2026, 14:45

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.9 CRITICAL
v3.1 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Aug 2026, 14:45
Published
Vulnerability first disclosed

Description

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Techniques & Countermeasures

  • CWE-88•Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

    The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected Systems

  • debian•incus

    < 6.0.4-2+deb13u9 | < 7.0.1-2

  • ubuntu•incus

    all

  • lxc•incus

    < 7.3.0

References (5)