Medium severity · published May 7, 2026
CVE-2026-41685
Incus: Unbounded binary import disk exhaustion
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
incus · lxc
< 7.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41685
Patch
https://github.com/lxc/incus/releases/tag/v7.0.0
Exploit
https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp
More from incus
9.9
CVE-2026-115377
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream
9.9
CVE-2026-115375
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes
9.9
CVE-2026-63343
Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
9.9
CVE-2026-63125
Incus vulnerable to root RCE via image backup.yaml symlink
9.9
CVE-2026-62941
Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge