Incus and Wasmtime: Three Isolation Escapes at 9.9 (CVE-2026-115377, 115375, 115384)

On October 22, 2026, NVD published three CVEs rated 9.9 in two open source isolation layers: Incus, the container and VM manager that grew out of LXD (two CVEs), and Wasmtime, the Bytecode Alliance's WebAssembly runtime.

What earns them that score is the scope change (S:C in the CVSS vector). In all three cases, someone who only has rights inside the isolated environment, or over what gets imported into it, ends up writing to the host.

The scores come from VulnCheck (CNA), all with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; VulnCheck rates each one 9.4 under CVSS 4.0. NVD hasn't analyzed them: Received for both Incus CVEs, Deferred for Wasmtime. None is in CISA KEV at the time of writing.

Incus — CVE-2026-115377: A Migration That Writes to the Host

When migrating an instance or volume, Incus receives the data as an rsync or btrfs receive stream. Per the NVD description, a malicious migration source can slip a symlink into it, such as a rootfs pointing at the host's root. Incus follows that link while writing the transferred data, so files land on the host, as root: full host compromise.

That puts any Incus server at risk if it accepts migrations from a server it doesn't fully control: a compromised cluster member, a remote server added as a remote, a shared environment.

Incus — CVE-2026-115375: The Booby-Trapped Backup

An Incus instance backup contains an index.yaml file describing, among other things, dependent custom volumes. Their names aren't validated. A client allowed to create instances can import a backup whose volume names contain ../ sequences and get Incus to create root-owned directories on the host, with content it controls. NVD again concludes full host compromise.

This bites hardest in multi-tenant setups, where the right to create instances is exactly what you hand out to users.

Wasmtime — CVE-2026-115384: A Stack Overflow from the Guest

Wasmtime runs untrusted WebAssembly in a sandbox. With the async component model (component-model-async), the result type of callback functions isn't validated. A malicious component that declares mistyped callbacks can make the host write roughly 16 KB onto the native stack, overwrite return addresses, and either crash the host or escape the sandbox.

Services that run third-party Wasm components are the ones exposed: function platforms, plugin systems, edge computing.

Fixed Versions

The NVD description gives "before X" ranges, so the versions below are the first ones outside the range on each branch.

• Incus: 6.0.7 (6.0 LTS), 7.0.2 (7.0 branch) and 7.5.0 (current branch) fix CVE-2026-115377; 7.0.2 and 7.5.0 fix CVE-2026-115375, which per NVD doesn't affect the 6.x branch.
• Wasmtime: 48.0.4 or 49.0.2 depending on your branch.

These are range bounds, not necessarily the latest releases: the Incus (lxc/incus) and Wasmtime (bytecodealliance/wasmtime) GitHub advisories in the references are authoritative. Distribution packages also carry their own patch numbering, so check those too.

Detection

• Versions: incus version on every server and cluster member; for Wasmtime, the wasmtime crate version in your services' Cargo.lock files, or in any runtime that embeds it.
• Incus: migration operations (incus monitor, daemon logs) coming from unexpected servers; backup imports (incus import) by non-admin users; recently created root-owned files or directories outside /var/lib/incus (or your configured storage path).
• Wasmtime: host process crashes while loading a component; components using async component-model functions when your service doesn't expect them.

Mitigation

1. Update Incus and Wasmtime to the versions above.
2. Incus, in the meantime: accept migrations only from trusted servers, temporarily remove backup-import rights from non-admin projects, and vet backups before importing them.
3. Wasmtime, in the meantime: if your service doesn't need the async component model, keep it disabled in the engine configuration, and refuse components from untrusted sources.
4. Defense in depth: a virtualization or Wasm execution host shouldn't carry other sensitive services. If isolation fails, the blast radius stays small.

Why Continuous Monitoring of Your Isolation Layers Matters

Incus and Wasmtime rarely make it into an inventory: one is an infrastructure layer installed once, the other a dependency buried inside a service. Yet they're what holds the line between what you run and what you own.

With cveo.tech, add your hypervisors and runtimes to your inventory and get an alert as soon as a critical CVE hits them.