A null-pointer dereference occurs during the import of a truncated S3 bucket backup file in Incus, a system container and virtual machine manager. The flaw leads to a daemon crash, resulting in a denial of service that can affect the availability of the entire Incus service on the host. The weakness is classified as CWE-476, indicating a lack of proper null reference checks during processing.

The vulnerability impacts the Incus product from the lxc:incus vendor. All releases before version 7.0.0 are affected, as the fix was introduced in the 7.0.0 release. Users running earlier versions should verify their installed version and plan to upgrade.

The CVSS score is 6.5, indicating moderate severity. No EPSS score is available, so the likelihood of exploitation is unknown, but the flaw requires an authenticated user with the ability to import a backup. The issue is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Attackers could trigger the crash by successfully authenticating to the Incus daemon and importing a crafted, incomplete backup file, causing the service to become unavailable.