CVE-2025-2713: medium-severity vulnerability in Google gVisor
Improper File Permission Handling in Google gVisor runsc
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.1%
Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
Google · gVisorRelated CVEs — Google gVisor
In the same product, most dangerous first.
CVE-2024-10603MEDIUMCVE-2024-10603EPSS 0.3%CVE-2024-10026MEDIUMImproved Seeding and Hashing In gVisorEPSS 0.2%CVE-2026-96812HIGHHost Root Sandbox Escape in gVisor via Character Device Passthrough and CUSEEPSS 0.1%CVE-2026-95702HIGHCode Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFileEPSS 0.1%