CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 is vulnerable to OS command injection (CWE-78) in the dom0 file-copy agent at core-admin-linux/file-copy-vm/qfile-dom0-agent.c, which processes an error message using the C "system" library function without guarding against shell metacharacters. The flaw is triggered when a user runs qvm-copy-to-vm from dom0 to a qube controlled by the attacker, and that qube returns an error message containing shell metacharacters that are then executed as shell commands in dom0. Because dom0 is Qubes' trusted administrative domain, a successful injection allows a compromised or malicious qube to execute arbitrary commands in dom0, breaking the isolation model and compromising the entire machine (CVSS scope-changed with high confidentiality, integrity, and availability impact). All Qubes OS installations running qubes-core-dom0-linux below 4.3.22 are affected, though exploitation requires an attacker-controlled qube plus a user-initiated file copy, which the high-complexity, user-interaction CVSS scores reflect. No public proof-of-concept or in-the-wild exploitation is known; EPSS assigns a 0.8% probability of exploitation within 30 days and the issue is not in CISA KEV.

What to do: Update dom0 through Qubes' normal dom0 update mechanism so that qubes-core-dom0-linux is 4.3.22 or later, and verify the installed package version. Until patched, avoid running qvm-copy-to-vm and related file-copy operations to any qube that may be compromised or attacker-controlled, since exploitation requires both an attacker-controlled qube and a user-initiated copy.