CVE-2025-31133highCWE-363CWE-61

CVE-2025-31133: high-severity vulnerability in opencontainers runc

runc container escape via "masked path" abuse due to mount race conditions

Published

Follow this CVE+ Monitor runc+ Monitor runc

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 1.2%
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
opencontainers · runc
Related CVEs — opencontainers runc

In the same product, most dangerous first.

CVE-2024-21626HIGHrunc container breakout through process.cwd trickery and leaked fdsEPSS 18.9%CVE-2021-43784MEDIUMOverflow in netlink bytemsg length field allows attacker to override netlink-based container configurationEPSS 1.8%CVE-2025-52565HIGHcontainer escape due to /dev/console mount and related racesEPSS 0.8%CVE-2025-52881HIGHrunc: LSM labels can be bypassed with malicious config using dummy procfs filesEPSS 0.8%CVE-2022-29162MEDIUMIncorrect Default Permissions in runcEPSS 0.4%CVE-2023-28642MEDIUMAppArmor bypass with symlinked /proc in runcEPSS 0.3%