LXD CVE-2026-16033

The attacker must hold low-privilege authenticated access to the LXD API (CVSS PR:L confirmed) - unauthenticated exploitation is not supported by the available vector. The attacker must be able to submit or reference a crafted image archive containing malicious metadata template directives with path traversal sequences. The vulnerability is specifically described as affecting the virtual machine/QEMU driver execution path, meaning instantiation of VM-type (not purely container-type) instances is the triggering condition. Limiting factors include: the PR:L requirement rules out fully unauthenticated remote exploitation; environments that restrict image ingestion to administrators only and do not permit untrusted users to supply or import images are not directly exploitable by low-privilege accounts; and pure-container-only LXD deployments (QEMU/VM driver disabled) may not be reachable via this specific code path.

The CVSS 8.5 score is substantiated across multiple vectors: network-accessible (AV:N), low complexity (AC:L), low privilege (PR:L), no user interaction (UI:N), and a scope change (S:C) with high confidentiality impact (C:H). The scope change is the most critical signal - it confirms that exploitation escapes the container/VM trust boundary and directly affects the host operating system, which is exactly the class of impact that makes LXD vulnerabilities severe in multi-tenant or cloud environments. The integrity impact (I:L) reflects unconstrained file creation but not arbitrary modification, though depending on the host configuration, file creation alone may be sufficient to achieve privilege escalation (e.g., writing to cron directories, SSH authorized_keys, or PAM config files). No EPSS score was provided, and no KEV listing is present, so the real-world exploitation rate is unknown. The PR:L requirement limits opportunistic mass exploitation - an attacker must have at minimum some LXD API access to submit or reference images. However, in shared LXD environments (cloud hosting, development platforms), low-privilege access is commonly granted to multiple users, significantly broadening the realistic attacker pool.

An attacker with low-privilege LXD API access (e.g., a developer account on a shared Ubuntu cloud platform) crafts a malicious image archive whose metadata template section contains path traversal sequences such as '../../etc/shadow' as a template destination path. When LXD processes the image to launch a VM instance, the QEMU driver materializes the template file at the traversed host path, returning the contents of /etc/shadow to the attacker or writing an attacker-controlled file to an arbitrary host location such as /etc/cron.d/. No public proof-of-concept code has been identified, but the attack requires only standard image archive crafting and LXD API access.