Incus, a system container and virtual machine manager, contains a flaw that allows a malicious image server to supply a crafted Incus-Image-Hash header. When the client receives this header, it writes an arbitrary file to the server’s filesystem, enabling an attacker to execute commands with root privileges. The weakness is a classic input validation error, listed as CWE‑20, and a hash validation flaw, listed as CWE‑345, and is limited to the client’s handling of image metadata.

All instances of Incus prior to version 7.2.0 are impacted. The vulnerability exists in the Incus client component used by the LXC Incus container manager. Upgrading to Incus 7.2.0 or later removes the flaw.

The vulnerability carries a CVSS score of 9.9, indicating critical severity. The EPSS score is 0.00439, indicating a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog, but the high CVSS suggests a potentially significant attack surface. The likely attack vector involves an attacker controlling or compromising an image server to supply a malicious header; if the Incus client accepts the header, the flaw can be exploited to achieve full root control of the server.