CVE-2026-41648

Incus, the system container and virtual machine manager, had a flaw where image and backup tarballs were unpacked and their YAML metadata parsed without size restrictions. A crafted file could cause the YAML parser to allocate a very large amount of memory, leading the host to exhaust available RAM and become unresponsive. The vulnerability is a classic example of unbounded memory allocation—CWE‑770—and can be exploited by an authenticated user to trigger a denial of service.

The weakness affected all Incus releases prior to version 7.0.0. Users running the open‑source distribution (vendor LXC, product Incus) before that patch were vulnerable. The advisory recommends using the 7.0.0 release or newer, which implements memory limits during YAML parsing.

The CVSS score of 5.3 classifies the issue as moderate severity. Although no EPSS score is publicly available and the vulnerability is not listed in the CISA KEV catalog, the exploit requires an authenticated upload of a malicious image or backup. In environments where image import is available to users, the attacker can intentionally cause server memory exhaustion by repeatedly submitting oversized YAML files, potentially taking the service offline. The risk is therefore moderate but could be high in highly available or multi‑tenant deployments.