Search: CVE-2026-47753

CVE-2026-47753 is a NULL pointer dereference vulnerability in the Incus system container and virtual machine manager prior to version 7.1.0. An authenticated user with permission to create instances can trigger a daemon crash by uploading a crafted backup tarball, causing denial of service across all projects on the affected cluster member. The issue arises from a missing null check on the Volume field in the instance-import path. Version 7.1.0 includes a patch that addresses this vulnerability.