CVE-2026-41647 — Incus is a system container and virtual machine manager.

title: Medium - CVE-2026-41647 - Incus Daemon Crash via Truncated Backup Import
id: scw-2026-05-07-ai-1
status: experimental
level: medium
description: |
  Detects the specific action of importing a storage bucket backup with Incus, which is the trigger for CVE-2026-41647. This can lead to a daemon crash (Denial of Service) if the backup file is truncated and error handling is missing, as described in the vulnerability details. This rule focuses on the direct impact vector of the CVE.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41647/
tags:
  - attack.impact
  - attack.t1499
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - '/incus'
      CommandLine|contains:
          - 'storage bucket import'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse