CVE-2026-63298

critical · 9.9

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.

9.9

CVSS

0.7%

EPSS (exploit prob.)

51st

EPSS percentile

2026-08-12

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
canonical	lxd	>= 4.0.0, < 4.0.12
canonical	lxd	>= 5.0.0, < 5.0.8
canonical	lxd	>= 5.1, < 5.21.6
canonical	lxd	>= 6.0, <= 6.9

Check a specific version with /api/v1/cve/match.

References

https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2
https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-63298