CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, "backend.CreateCustomVolumeFromBackup" in "internal/server/storage/backend.go" contains an unguarded "time.Time" dereference on the "ExpiresAt" field of every volume-snapshot entry in an imported custom-volume backup...

CVE-2026-48756

CVE-2026-48756 is a nil-pointer dereference (CWE-476) in Incus , a system container and VM manager. The vulnerable function CreateCustomVolumeFromBackup in internal/server/storage/backend.go dereferences *snapshot.ExpiresAt without a nil-check when importing a custom-volume backup whose volume_sn...