CVE catalog

CVE-2026-33711

Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is t

[CVE catalog]

Severity: High · CVSS 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Mar 26, 2026, 10:37:29 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 25, 2026

A flaw was found in Incus, a system container and virtual machine manager. A local attacker could exploit a vulnerability in the API responsible for retrieving VM screenshots. By creating symbolic links (symlinks) in predictable temporary file paths, an attacker could trick Incus into truncating and altering arbitrary files on the filesystem. This could lead to a denial of service or, in specific configurations where the `protected_symlinks` kernel security feature is disabled, a local privilege escalation. This Important flaw in Incus allows a local attacker to achieve denial of service or, under specific conditions, local privilege escalation. The vulnerability arises from predictable temporary file paths used during VM screenshot retrieval, enabling symlink attacks. On Red Hat Enterprise Linux, the `protected_symlinks` kernel security feature is enabled by default, which prevents the privilege escalation vector of this flaw. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	incus	Not reported	`6.23.0`	fixed
Debian	incus	13	`6.0.4-2`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u10`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u11`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u1~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u2`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u2~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u3`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u3~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u4`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u4~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u5`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u5~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u6`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u6~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u7`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u7~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u8`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u9`	vulnerable
Debian	incus	13	`6.0.4-3`	vulnerable
Debian	incus	13	`6.0.5-1`	vulnerable
Debian	incus	13	`6.0.5-2`	vulnerable
Debian	incus	13	`6.0.5-3`	vulnerable
Debian	incus	13	`6.0.5-4`	vulnerable
Debian	incus	13	`6.0.5-5`	vulnerable
Debian	incus	13	`6.0.5-6`	vulnerable
Debian	incus	13	`6.0.5-7`	vulnerable
Debian	incus	13	`6.0.5-8`	vulnerable
Debian	incus	13	`6.0.6-1`	vulnerable
Debian	incus	13	`6.0.6-2`	vulnerable
Debian	incus	13	`6.0.6-3`	vulnerable
Debian	incus	13	`6.14.0-1~exp1`	vulnerable
Debian	incus	13	`6.15.0-1~exp1`	vulnerable
Debian	incus	13	`6.16.0-1~exp1`	vulnerable
Debian	incus	13	`6.17.0-1~exp1`	vulnerable
Debian	incus	13	`6.20.0-1~exp1`	vulnerable
Debian	incus	13	`6.21.0-1~exp1`	vulnerable
Debian	incus	13	`6.22.0-1~exp1`	vulnerable
Debian	incus	13	`6.23.0-1~exp1`	vulnerable
Debian	incus	13	`7.0.0-1`	vulnerable
Debian	incus	13	`7.0.0-1~bpo13+1`	vulnerable
Debian	incus	13	`7.0.0-2`	vulnerable
Debian	incus	13	`7.0.0-2~bpo13+1`	vulnerable
Debian	incus	13	`7.0.0-3`	vulnerable
Debian	incus	13	`7.0.0-4`	vulnerable
Debian	incus	13	`7.0.0-5`	vulnerable
Debian	incus	13	`7.0.0-5~bpo13+1`	vulnerable
Debian	incus	13	`7.0.1-1`	vulnerable
Debian	incus	13	`7.0.1-1~bpo13+1`	vulnerable
Debian	incus	13	`7.0.1-2`	vulnerable
Debian	incus	13	`7.0.1-2~bpo13+1`	vulnerable
Debian	incus	13	`7.0.1-3`	vulnerable
Debian	incus	13	`7.0.1-3~bpo13+1`	vulnerable
Debian	incus	13	`7.0.1-4`	vulnerable
Debian	incus	13	`7.0.1-5`	vulnerable
Debian	incus	13	`7.1.0-1~exp1`	vulnerable
Debian	incus	13	`7.2.0-1~exp1`	vulnerable
Debian	incus	13	`7.2.0-1~exp2`	vulnerable
Debian	incus	13	`7.2.0-1~exp3`	vulnerable
Debian	incus	13	`7.3.0-1~exp1`	vulnerable
Debian	incus	13	`7.4.0-1~exp1`	vulnerable
Debian	incus	13	`7.5.1-1~exp1`	vulnerable
Debian	incus	14	`6.0.4-2`	vulnerable
Debian	incus	14	`6.0.4-3`	vulnerable
Debian	incus	14	`6.0.5-1`	vulnerable
Debian	incus	14	`6.0.5-2`	vulnerable
Debian	incus	14	`6.0.5-3`	vulnerable
Debian	incus	14	`6.0.5-4`	vulnerable
Debian	incus	14	`6.0.5-5`	vulnerable
Debian	incus	14	`6.0.5-6`	vulnerable
Debian	incus	14	`6.0.5-7`	vulnerable
Debian	incus	14	`6.0.5-8`	vulnerable
Debian	incus	14	`6.0.6-1`	vulnerable
Debian	incus	14	`6.0.6-2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Cpe	incus	cpe	Not reported	`6.23.0`	Not reported	Not reported	Not reported
Debian	incus	deb	14	`6.0.6-2`	Not reported	DEBIAN-CVE-2026-33711	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[golang-github-lxc-incus-dev]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · all · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · all · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · all · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · all · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · all · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · all · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · all · trixie-security
  Affected
  nvd · incus · debian · 13
[incus]Affected
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13
[incus-agent]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13
[incus-base]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13
[incus-client]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13
[incus-extra]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13

Observed: Oct 27, 2026, 8:01:33 AM UTC

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]