Cloudanix VulnDB

CVE-2025-64507

High · 8.4

Incus vulnerable to local privilege escalation through custom storage volumes

CVSS

8.4

EPSS

0.2%

Published

Nov 13, 2025

CISA due date

—

The record

This affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unpriivleged user on the host to gain root privileges.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/lxc/incus 0 No fix
Go github.com/lxc/incus/v6 0 No fix
Go github.com/lxc/incus/v6 6.1.0 No fix
go github.com/lxc/incus/v6 6.1.0 No fix

Related vulnerabilities