Threats Tagged 'cve-2026-33711'

CVE-2026-33711 is a medium severity vulnerability in Incus, a system container and VM manager, affecting versions prior to 6.23.0. The vulnerability arises from the use of predictable temporary file paths under /tmp for VM screenshots, allowing a local attacker to create symlinks that can be abused. On most Linux systems, a kernel security feature called protected_symlinks prevents exploitation, resulting in a permission denied error. However, on systems where this feature is disabled, an attacker can cause Incus to truncate and modify arbitrary files, potentially leading to denial of service or local privilege escalation. The issue is fixed in version 6.23.0.