{"action":"Upgrade lxd to 5.0.2+git20231211.1364ae4-9+deb13u4 or later.","affected":[{"fixed":"5.0.2+git20231211.1364ae4-9+deb13u4","introduced":"0"}],"component":"lxd","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["5.0.2+git20231211.1364ae4-9+deb13u4"],"id":"tcs_01M5NRRDCSW4X8P9PX2GVCE1K0","modified_at":"2026-10-01T03:03:22.206202594Z","published_at":"2026-03-26T23:16:20.743Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-33897","https://security-tracker.debian.org/tracker/CVE-2026-33897"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-33897#Debian:13/lxd","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-33897"}],"summary":"Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root on the host server. Incus allows for pon"}