# LXD 4.0.14 release notes This is a [LTS release](https://canonical.com/lxd/docs/latest/reference/releases-snap/index.html.md#ref-releases-lts) and is recommended for production use. This is a maintenance release for the 4.0 LTS series. It focuses on build reliability fixes backported from the main development branch. ## Bug fixes The following bug fixes are included in this release. - [Avoid pulling Go modules from Bazaar VCS during source builds](https://github.com/canonical/lxd/pull/19013) - [Arbitrary file write on host via symlink in migration stream (CVE-2026-87799)](https://github.com/canonical/lxd/security/advisories/GHSA-fmc3-3cpq-6whr) - [btrfs optimized backup/migration: unvalidated subvolume path enables root arbitrary file delete/write (RCE ceiling) (CVE-2026-85185)](https://github.com/canonical/lxd/security/advisories/GHSA-27q7-qwhm-c34p) - [Path traversal via btrfs optimized-backup subvolumes[].path enables root file/dir manipulation (CVE-2026-85526)](https://github.com/canonical/lxd/security/advisories/GHSA-h85r-gjgx-g2rv) - [Malicious agent in a VM can escape the target directory of a recursive file pull (CVE-2026-87798)](https://github.com/canonical/lxd/security/advisories/GHSA-mr8v-hx34-hfvf) - [CLI path traversal when exporting an image from a malicious server (CVE-2026-86334)](https://github.com/canonical/lxd/security/advisories/GHSA-g4cm-f533-78hq) ## Change log View the [complete list of all changes in this release](https://github.com/canonical/lxd/compare/lxd-4.0.13...lxd-4.0.14). ## Downloads The source tarballs and binary clients can be found on our [download page](https://github.com/canonical/lxd/releases/tag/lxd-4.0.14). Binary packages are also available for: - **Linux:** `snap install lxd --channel=4.0/stable` - **macOS client:** `brew install lxc` - **Windows client:** `choco install lxc`