GO-2026-5810 CVE-2026-48756 GHSA-xhqx-mgh3-3h7q

Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus

Low Go

Severity: 0.0 / 10; Low · CVSS 4.0
Exploit chance (EPSS): 0.38%; Chance of exploitation in the next 30 days. Higher than 32.24% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-476 NULL Pointer Dereference
Fix: Available; 2 packages have a fixed version

Description

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/lxc/incus	`all versions`	No fix yet
github.com/lxc/incus/v6	`all versions`	No fix yet
github.com/lxc/incus/v7	`< 7.1.0`	`7.1.0`
github.com/lxc/incus/v7/cmd/incusd	`< 7.1.0`	`7.1.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/lxc/incus/v7 Go → `7.1.0`

go

go get github.com/lxc/incus/v7@v7.1.0 && go mod tidy

github.com/lxc/incus/v7/cmd/incusd Go → `7.1.0`

go

go get github.com/lxc/incus/v7/cmd/incusd@v7.1.0 && go mod tidy

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None
Exploit maturity: Proof of concept

Weakness

CWE-476: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How to prevent it

Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Requirements: Select a programming language that is not susceptible to these issues.
Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.

References

Packages

github.com/lxc/incus

Timeline

Jun 26, 2026 Published
Oct 15, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GO-2026-6319 Incus has a project restriction bypass in instance copy across projects	High	Also affects github.com/lxc/incus
GHSA-64f3-v33m-w89f Incus has a project restriction bypass for custom volume copy across projects	High	Also affects github.com/lxc/incus
GO-2026-5806 Incus has an arbitrary file write on its client due to trusted image hash	Critical	Also affects github.com/lxc/incus
GO-2026-5808 Incus has an argument injection in backup compression algorithm leading to AFW and ACE	Critical	Also affects github.com/lxc/incus
GO-2026-5800 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}	Low	Also affects github.com/lxc/incus
GO-2026-5802 Incus has an arbitrary file write via path traversal in S3 multipart upload	Critical	Also affects github.com/lxc/incus
GO-2026-5803 Incus has arbitrary file read+write on host via templates/ symlink in malicious image	Critical	Also affects github.com/lxc/incus
GO-2026-5799 Incus has a restricted project bypass leading to arbitrary command execution	Critical	Also affects github.com/lxc/incus

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor