VDB
CVE-2026-63298
CVE-2026-63298
PUBLISHED
CVSS 8.7 HIGH
Reported by canonical · Published August 12, 2026
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
Risk Scores
CVSS 3.1
8.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | LXD | 5.0.0, 5.21.0, 4.0.0 |
| Canonical | LXD | 5.0.0, 5.21.0, 4.0.0 |
Timeline
- Aug 12, 2026 CVE Published
- Aug 13, 2026 Coalition ESS Score
- Aug 20, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 4, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 11, 2026 CVE Updated
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score