{
  "affected": [
    {
      "affectedData": [
        {
          "product": "incus",
          "vendor": "lxc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check \u2014 the asymmetric guard is the bug. Version 7.1.0 contains an updated patch."
    },
    {
      "lang": "es",
      "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.1.0, \u0027(backend).CreateCustomVolumeFromBackup\u0027 en \u0027internal/server/storage/backend.go\u0027 contiene una desreferencia de \u0027time.Time\u0027 sin protecci\u00f3n en el campo \u0027ExpiresAt\u0027 de cada entrada de instant\u00e1nea de volumen en una copia de seguridad de volumen personalizado importada. Un usuario autenticado con permiso \u0027can_create_storage_volumes\u0027 en cualquier proyecto puede bloquear el demonio \u0027incusd\u0027 al subir un tarball de copia de seguridad cuyo campo \u0027volume_snapshots[*].expires_at\u0027 est\u00e1 ausente. Esta es una variante de campo hermano de GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). El commit \u0027985a1dedf9f3e7ba729c93b654905ed510de25c2\u0027 a\u00f1adi\u00f3 \u0027if s == nil\u0027 al principio del cuerpo del bucle, pero no protegi\u00f3 la desreferencia adyacente de \u0027snapshot.ExpiresAt\u0027 19 l\u00edneas m\u00e1s tarde. Cada otro consumidor de \u0027Config.VolumeSnapshots[i].ExpiresAt\u0027 en este mismo archivo ya protege la desreferencia con una comprobaci\u00f3n de nulo - la protecci\u00f3n asim\u00e9trica es el error. La versi\u00f3n 7.1.0 contiene un parche actualizado."
    }
  ],
  "id": "CVE-2026-48756",
  "lastModified": "2026-10-15T19:10:00.173",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48756",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T20:58:24.750230Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T15:16:41.210",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lxc/incus/security/advisories/GHSA-xhqx-mgh3-3h7q"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}