A critical vulnerability in the Incus client allows a malicious image server to execute arbitrary code with root privileges on the client system.

This is an input validation vulnerability (CWE-20) in the Incus client. An attacker controlling an image server can supply a crafted Incus-Image-Hash header to trigger an arbitrary file write on the client machine, which can be leveraged to gain root-level command execution.

This vulnerability carries a CVSS score of 9.9, indicating an extreme risk to any environment that consumes images from potentially untrusted or compromised servers. Successful exploitation results in full control over the client system, including root access, which could lead to complete data breach or infrastructure takeover.

Immediate Action: Update the Incus client to version 7.2.0 or later to patch the header validation logic.

Proactive Monitoring: Monitor client-side logs for unexpected file system activities or unauthorized processes running with root permissions following image import operations.

Compensating Controls: Only pull images from trusted, verified, and internal image repositories to mitigate the risk of interacting with a malicious server.

Public Exploit Available: Unknown (no confirmed public weaponized exploit was identified in the provided sources).

The severity of this vulnerability, combined with the documented existence of a proof-of-concept, necessitates immediate action. All Incus clients should be updated to version 7.2.0 to remediate this critical flaw and prevent potential root-level escalation.