🛡️ CVE-2025-64507 on Debian — incus

⚪ Unknown ✅ No Known Exploit OSV

N/A

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true as well as access to the host as an unprivileged user. The most common case for this would be systems using incus-user with the less privileged incus group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a patched version of Incus is deployed.

Distribution advisory

This page covers CVE-2025-64507 as tracked by Debian, for the package incus. The fix is available in version 6.0.5-4; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

Affected software

DEBIAN-CVE-2025-64507 is recorded against 2 packages.

incus (fixed in 6.0.5-4)
lxd (fixed in 5.0.2+git20231211.1364ae4-9+deb13u2)

Timeline and source

Published on 10 November 2025 and last revised on 4 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

security-tracker.debian.org (Advisory)

CVE-2025-64507 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Base record Ubuntu

Details

Severity Unknown

CVSS Score N/A

CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE N/A

Public Exploit ✅ No

Source OSV

Published 2025-11-10

Updated 2026-08-12

Modified 2026-08-04

Fix URL N/A

Affected Packages

Software	From version	Fixed in
incus	—	6.0.5-4
lxd	—	5.0.2+git20231211.1364ae4-9+deb13u2

References

ADVISORY https://security-tracker.debian.org/tracker/CVE-2025-64507

🔗 NVD 🔗 Mitre

Similar Threats

Site Security Check

Is incus part of your stack?

DEBIAN-CVE-2025-64507 is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.