Critical severity9.9NVD Advisory· Published Aug 21, 2026· Updated Aug 21, 2026

CVE-2026-48749

Description

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/lxc/incus/v7/cmd/incusdGo	< 7.2.0	7.2.0

Affected products

Lxc/Incusllm-fuzzy
Range: <7.2.0
osv-coords
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Range: < 0.0.20260723T184607-160000.1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-2q3f-q5pq-g8wvghsaADVISORY
github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wvnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000