The vulnerability is a nil‑pointer dereference in the custom volume import subsystem of Incus, a container and virtual machine manager. During an import of a backup archive that contains a null entry in the volume_snapshots array, the daemon blindly accesses fields such as Name, Config, Description, CreatedAt, and ExpiresAt on a pointer that was not initialized. This causes the Incus daemon to crash, making the node unavailable to legitimate users. The weakness is a classic null‑pointer dereference, which the CNA classifies as CWE‑476.

Affecting all Incus installations running a version older than 7.0.0. The issue has been corrected in 7.0.0, so any system using 7.0.0 or later is safe. Until an upgrade can be performed, the vulnerability remains in any system that allows authenticated users to import custom volume backups.

The CVSS base score is 7.1, indicating a moderate‑to‑high severity. The exploit requires a user with permission to import storage volumes, so an authenticated adversary with such privileges can trigger it. The vulnerability is not listed in the CISA KEV catalog, and no EPSS data is available, so the exploitation probability is unknown. The denial of service can be repeated, potentially keeping an affected node offline for extended periods. The impact is therefore a system availability loss that could disrupt services relying on Incus.