What is CVE-2026-63298?

CVE-2026-63298 is a critical-severity vulnerability in Canonical Lxd, classified under OS Command Injection. CVSS score: 9.9/10. Published 2026-08-12.

How severe is CVE-2026-63298?

Critical severity. CVSS v3 base score is 9.9 out of 10.

RCE in Canonical Lxd

CVE-2026-63298

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia…

Vulnerability class: Command Injection (OS Command Injection)

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Canonical Lxd — versions 5.0.0, 5.21.0, 4.0.0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security@ubuntu.com (vendor-advisory, vdb-entry)

Frequently asked questions

What is CVE-2026-63298?: CVE-2026-63298 is a critical-severity vulnerability in Canonical Lxd, classified under OS Command Injection. CVSS score: 9.9/10. Published 2026-08-12.
How severe is CVE-2026-63298?: Critical severity. CVSS v3 base score is 9.9 out of 10.