UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64507

Local privilege escalation through custom storage volumes

Severity
High 8.6
Published
10 Nov 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.0.6, 6.19.0
Also known as
GHSA-56mx-8g9f-5crf
Sources
NVD, Project advisories (GitHub)

Description

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be…

Affected software

SoftwareAffected versions
IncusServers and applications · cpe:a:linuxcontainers:incus
  • Every version before 6.0.6
  • From 6.1.0 before 6.19.0
IncusServers and applications · github:lxc/incus
  • Every version before 6.19.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64507
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64507
  • GitHub Advisory Database https://github.com/advisories/GHSA-56mx-8g9f-5crf
  • github.com https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf