CVE-2026-82636

Name of the Vulnerable Software and Affected Versions Qubes OS versions prior to 4.3.22

Description OS command injection is possible during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c because the system() library function is used to process an error message that may contain shell metacharacters, which are characters that can be used to change the meaning of a command in a shell environment.

Recommendations Update to version 4.3.22 or later.