Read the docs
TI-2025-32660 Aliases CVE-2025-52565GHSA-qw9x-cqr3-wc7r

container escape due to /dev/console mount and related races

Priority LOW 38CWE-363Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00811 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed runc (opencontainers): 1.2.8, 1.3.3, 1.4.0-rc.3github.com/opencontainers/runc (Go): 1.2.8, 1.3.3, 1.4.0-rc.3Red Hat: 31 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagerunc1.0.0-rc3 to before 1.2.8; 1.3.0-rc.1 to before 1.3.3; 1.4.0-rc.1 to before 1.4.0-rc.31.2.8, 1.3.3, 1.4.0-rc.3Patch availableCNA
—github.com/opencontainers/runc (Go)1.0.0-rc3 to before 1.2.81.2.8Patch availableGHSA-qw9x-cqr3-wc7r
—github.com/opencontainers/runc (Go)1.3.0-rc.1 to before 1.3.31.3.3Patch availableGHSA-qw9x-cqr3-wc7r
—github.com/opencontainers/runc (Go)1.4.0-rc.1 to before 1.4.0-rc.31.4.0-rc.3Patch availableGHSA-qw9x-cqr3-wc7r
  • runc Vendorbackstage Affected 1.0.0-rc3 to before 1.2.8; 1.3.0-rc.1 to before 1.3.3; 1.4.0-rc.1 to before 1.4.0-rc.3 Fixed in 1.2.8, 1.3.3, 1.4.0-rc.3 Patch available CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.0.0-rc3 to before 1.2.8 Fixed in 1.2.8 Patch available GHSA-qw9x-cqr3-wc7r
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.3.0-rc.1 to before 1.3.3 Fixed in 1.3.3 Patch available GHSA-qw9x-cqr3-wc7r
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.4.0-rc.1 to before 1.4.0-rc.3 Fixed in 1.4.0-rc.3 Patch available GHSA-qw9x-cqr3-wc7r

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*1.0.1 to before 1.2.8; 1.3.0 to before 1.3.3Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*1.0.0 rc3Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*1.0.0 rc4Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*1.0.0 rc5Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*1.0.0 rc6Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*1.0.0 rc7Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*1.0.0 rc8Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:*1.0.0 rc9Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90:*:*:*:*:*:*1.0.0 rc90Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91:*:*:*:*:*:*1.0.0 rc91Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions 1.0.1 to before 1.2.8; 1.3.0 to before 1.3.3 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:* Versions 1.0.0 rc3 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:* Versions 1.0.0 rc4 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:* Versions 1.0.0 rc5 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:* Versions 1.0.0 rc6 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:* Versions 1.0.0 rc7 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:* Versions 1.0.0 rc8 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:* Versions 1.0.0 rc9 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90:*:*:*:*:*:* Versions 1.0.0 rc90 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91:*:*:*:*:*:* Versions 1.0.0 rc91 Vulnerable ·backstage
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92:*:*:*:*:*:*1.0.0 rc92Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93:*:*:*:*:*:*1.0.0 rc93Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94:*:*:*:*:*:*1.0.0 rc94Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc95:*:*:*:*:*:*1.0.0 rc95Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:*1.4.0 rc1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:*1.4.0 rc2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92:*:*:*:*:*:* Versions 1.0.0 rc92 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93:*:*:*:*:*:* Versions 1.0.0 rc93 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94:*:*:*:*:*:* Versions 1.0.0 rc94 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc95:*:*:*:*:*:* Versions 1.0.0 rc95 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:* Versions 1.4.0 rc1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:* Versions 1.4.0 rc2 Vulnerable ·backstage

Remediation

  • Fix · CNA runc (opencontainers) Fixed in 1.2.8, 1.3.3, 1.4.0-rc.3
  • Fix · GHSA-qw9x-cqr3-wc7r github.com/opencontainers/runc (Go) Fixed in 1.2.8 Advisory →
  • Fix · GHSA-qw9x-cqr3-wc7r github.com/opencontainers/runc (Go) Fixed in 1.3.3 Advisory →
  • Fix · GHSA-qw9x-cqr3-wc7r github.com/opencontainers/runc (Go) Fixed in 1.4.0-rc.3 Advisory →

Red Hat 31 advisories

  • RHSA-2026:10703 Released 2026-04-27 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.src::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.aarch64::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.ppc64le::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.s390x::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.src::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8 +47
  • RHSA-2026:8325 Released 2026-04-15 · Red Hat rating Important
    buildah, crun, podman, runc, and skopeo security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) buildah-1:1.26.9-1.el9_0.3, buildah-tests-1:1.26.9-1.el9_0.3, podman-2:4.2.0-6.el9_0.6 +9
  • RHSA-2026:6492 Released 2026-04-09 · Red Hat rating Important
    OpenShift Container Platform 4.12.87 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202604010116-0
Show 28 more Red Hat advisories
  • RHSA-2026:4693 Released 2026-03-17 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8, buildah-1:1.29.7-1.module+el8.8.0+24026+ca15dd94.src::container-tools:rhel8 +47
  • RHSA-2026:4531 Released 2026-03-12 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) runc-4:1.2.9-1.el9_2.1
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:1540 Released 2026-02-05 · Red Hat rating Important
    OpenShift Container Platform 4.15.61 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.15 python-eventlet-0.33.1-7.el9, python3-eventlet-0.33.1-7.el9
    • Red Hat OpenShift Container Platform 4.15 bpftool-7.0.0-284.155.1.el9_2, kernel-5.14.0-284.155.1.el9_2, kernel-64k-5.14.0-284.155.1.el9_2 +47
  • RHSA-2026:0995 Released 2026-01-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.61 packages and security update
    • Red Hat OpenShift Container Platform 4.14 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0676 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.13.63 packages and security update
    • Red Hat OpenShift Container Platform 4.13 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0701 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.17.47 packages and security update
    • Red Hat OpenShift Container Platform 4.17 runc-4:1.2.9-1.rhaos4.17.el9
  • RHSA-2026:0418 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.16.55 packages and security update
    • Red Hat OpenShift Container Platform 4.16 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0331 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.31 packages and security update
    • Red Hat OpenShift Container Platform 4.18 runc-4:1.2.9-1.rhaos4.18.el8, runc-4:1.2.9-1.rhaos4.18.el9
  • RHSA-2026:0315 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.84 packages and security update
    • Red Hat OpenShift Container Platform 4.12 runc-4:1.2.9-1.rhaos4.17.el8
  • RHSA-2026:0425 Released 2026-01-12 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) runc-4:1.2.9-1.el9_4
  • RHSA-2025:23113 Released 2026-01-07 · Red Hat rating Important
    OpenShift Container Platform 4.15.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202512100122-0, rhcos-ppc64le-415.92.202512100122-0, rhcos-s390x-415.92.202512100122-0 +1
  • RHSA-2025:23449 Released 2025-12-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23209 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (TPU)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-tpu-rhel9
  • RHSA-2025:23205 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23204 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:23202 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:23080 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:23079 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23078 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:22275 Released 2025-12-05 · Red Hat rating Important
    OpenShift Container Platform 4.13.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202511261311-0
  • RHSA-2025:21824 Released 2025-11-27 · Red Hat rating Important
    OpenShift Container Platform 4.16.53 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202511191934-0, rhcos-ppc64le-416.94.202511191934-0, rhcos-s390x-416.94.202511191934-0 +1
  • RHSA-2025:21795 Released 2025-11-27 · Red Hat rating Important
    OpenShift Container Platform 4.18.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202511170715-0, rhcos-ppc64le-418.94.202511170715-0, rhcos-s390x-418.94.202511170715-0 +1
  • RHSA-2025:21328 Released 2025-11-20 · Red Hat rating Important
    OpenShift Container Platform 4.14.59 packages and security update
    • Red Hat OpenShift Container Platform 4.14 containernetworking-plugins-1:1.4.0-5.rhaos4.14.el8, cri-o-1.27.8-16.rhaos4.14.gite1422c1.el8, cri-o-1.27.8-16.rhaos4.14.gite1422c1.el9 +8
  • RHSA-2025:21232 Released 2025-11-13 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.s390x::container-tools:rhel8 +47
  • RHSA-2025:20957 Released 2025-11-11 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.3.0-4.el9_7
  • RHSA-2025:19927 Released 2025-11-07 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.2.5-3.el9_6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference Server 3.2Fixed RHSA-2025:23078, RHSA-2025:23079, RHSA-2025:23080, RHSA-2025:23202, RHSA-2025:23204, RHSA-2025:23205, RHSA-2025:23209, RHSA-2025:23449, RHSA-2026:3461, RHSA-2026:3462
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:21232
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:19927, RHSA-2025:20957
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:4693
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:8325
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:4531
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:0425
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:4693
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:0315, RHSA-2026:6492
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:22275, RHSA-2026:0676
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:21328, RHSA-2026:0995
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:23113, RHSA-2026:1540
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:21824, RHSA-2026:0418
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:0701
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:21795, RHSA-2026:0331
Red Hat OpenShift Container Platform 4.19Fixed—
Red Hat OpenShift Container Platform 4.20Fixed—
Not affected: 11 products
  • Ironic content for Red Hat OpenShift Container Platform 4.15
  • Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52565
  2. 2026-10-03 Alias added: GHSA-qw9x-cqr3-wc7r
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-25 EPSS moved to the 50th–90th percentile
  5. 2026-10-30 Fix available: Red Hat OpenShift Container Platform 4.19 · Red Hat

References

Exploit 1

Patch 8

Advisory 1

Other 1

  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2024-14351 runc container breakout through process.cwd trickery and leaked fds CVSS 3.1HIGH 8.6
  • TI-2021-10869 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. CVSS 3.1HIGH 8.5
  • TI-2019-12591 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows… CVSS 3.1HIGH 7.5
  • TI-2025-22394 runc container escape via "masked path" abuse due to mount race conditions CVSS 4.0HIGH 7.3
  • TI-2025-32917 runc: LSM labels can be bypassed with malicious config using dummy procfs files CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences