The vulnerability arises because Incus performs a project restriction check before inheriting configuration from the source instance during a cross‑project copy. If the source instance contains dangerous keys such as security.privileged, raw.lxc, or raw.apparmor, those keys are merged after the check passes, allowing the attacker to inject elevated privileges into the target project. This can let a low‑privileged user create a privileged container, effectively bypassing project boundaries and potentially compromising system integrity and confidentiality. The weakness maps to CWE‑863, a configuration‑related boundary‑check bypass.

Incus, the system container and virtual‑machine manager from the LXC project, is affected. Any instance copied between projects on Incus versions prior to 7.3.0 is vulnerable. The patch that fixes the issue was introduced in Incus 7.3.0. The product is typically deployed in environments where multiple isolated projects exist, such as shared hosting or multi‑tenant cloud infrastructures.

The CVSS score of 9.9 indicates a critical severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, which means no publicly reported exploit yet. Nevertheless, the attack vector is straightforward: an authorized user who can request an instance copy across projects can trigger the exploit by using a source instance that contains privileged configuration keys. The exploit does not require additional privileges beyond the copy operation and can be executed locally from within an Incus deployment or via the REST API if access is granted.