CVE-2026-40251 is a vulnerability in Incus prior to version 7.0.0 where improper bounds checking in the storage volume import logic can cause the Incus daemon to panic and crash. This occurs due to an incorrect length check when indexing snapshot metadata arrays during backup restore and migration operations. An authenticated user with access to the storage volume feature can exploit this by submitting a specially crafted backup archive that triggers out-of-bounds access, resulting in a denial of service by crashing the daemon.