CVE-2026-33711

CVE-2026-33711 affects Incus, a system container and virtual machine manager, specifically versions prior to 6.23.0. A local attacker can exploit predictable temporary file paths used for VM screenshots by creating symlinks. This vulnerability, rated High (CVSS 7.8), allows an attacker with local access and low privileges to potentially cause denial of service, truncate arbitrary files, or achieve local privilege escalation on systems where the Linux kernel's protected_symlinks feature is disabled. While the vulnerability has garnered some community discussion, there is currently no evidence of active exploitation, nor are public exploit codes available.