CVE-2026-82636
Received Received - Intake

Qubes OS dom0 Command Injection via qvm-copy-to-vm

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: MITRE

Description
Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82636
EUVD
EUVD-2026-68212

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
qubes qubes_os to 4.3.22 (exc)
qubes qubes_core_dom0_linux 4.3.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82636 is a command injection vulnerability in Qubes OS where an attacker can execute arbitrary code in dom0 (the administrative domain) through the qvm-copy-to-vm tool. The issue occurs when error reporting in dom0 processes a malicious filename containing shell metacharacters that are not properly sanitized. The system() function is used to display error messages, which executes the attacker-controlled filename as a shell command.

Detection Guidance

This vulnerability cannot be directly detected through network scanning or standard commands as it requires specific conditions to be exploited. Focus on verifying if your Qubes OS system is running the patched version of qubes-core-dom0-linux (4.3.22 or later) using the Qubes Update tool in dom0.

Impact Analysis

This vulnerability allows an attacker with control over a compromised qube to execute arbitrary code in dom0, which is the most privileged domain in Qubes OS. This could lead to full system compromise, data theft, or further attacks on other VMs. The exploit requires the attacker to control the filename being copied, which may be feasible if users perform file operations in dom0.

Compliance Impact

This vulnerability primarily affects Qubes OS's isolation model, allowing code execution in dom0 from an attacker-controlled qube. While not directly tied to GDPR or HIPAA, it undermines security controls required by these regulations, such as data integrity and access control. Dom0 compromise could lead to unauthorized data access or manipulation, violating compliance requirements for data protection and system integrity.

Mitigation Strategies

Update the qubes-core-dom0-linux package to version 4.3.22 or later in dom0 using the Qubes Update tool. No additional user action is required beyond normal updates. Verify the authenticity of the update using PGP signatures as provided in QSB 118.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82636. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart