Privilege escalation in Linuxcontainers Incus
CVE-2025-64507
Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage…
Vulnerability class: Privilege Escalation
EPSS: 0.002 (5.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linuxcontainers Incus
- Lxc Incus — versions < 6.0.6, >= 6.1.0, < 6.19.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Vendor Advisory)
- security-advisories@github.com (Exploit, Patch, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Exploit, Patch, x_refsource_MISC, Issue Tracking)
Frequently asked questions
- What is CVE-2025-64507?
- CVE-2025-64507 is a high-severity vulnerability in Linuxcontainers Incus, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2025-11-10.
- How severe is CVE-2025-64507?
- High severity. CVSS v3 base score is 7.8 out of 10.