CVEvulnerability
CVE-2026-63298
9.9 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-08-12
- Last modified
- 2026-10-24
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
Affected configurations
• canonical lxd (>= 4.0.0 < 4.0.12)
• canonical lxd (>= 5.0.0 < 5.0.8)
• canonical lxd (>= 5.1 < 5.21.6)
• canonical lxd (>= 6.0 <= 6.9)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2 Vendor Advisory, Exploit, Mitigation
- https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2 Vendor Advisory, Exploit, Mitigation