Incus, a system container and virtual machine manager, fails to validate the combined fingerprint of images downloaded from simplestreams servers before storing them in its local cache. This omission allows an attacker to perform image cache poisoning, such that a malicious image is cached under the expectation of a legitimate one. If a victim tenant subsequently runs the corrupted image, the attacker can execute arbitrary code within the tenant, potentially escalating privileges to the host. The vulnerability stems from a lack of cryptographic verification (CWE‑295) and improper handling of trust boundaries (CWE‑354).

The issue affects Incus versions earlier than 6.23.0 from the Linux Containers project. Users running these versions are susceptible to the described image cache poisoning risk.

The CVSS score of 5.7 indicates a moderate severity, while the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to infiltrate or trick the development of a simplestreams image server or otherwise supply a malicious image via the network, leading to potential compromise when tenants consume the poisoned artifact.