CVE-2025-31133

Name of the Vulnerable Software and Affected Versions runc versions 1.2.0 through 1.2.7 runc versions 1.3.0-rc.1 through 1.3.1 runc versions 1.4.0-rc.1 through 1.4.0-rc.2

Description An issue exists in the maskedPaths function where insufficient verification of the bind-mount source occurs when using the container's /dev/null to mask. This creates a race condition that allows symlink following, enabling an arbitrary mount gadget. This can lead to container escape, host information disclosure, host denial of service, or the bypassing of maskedPaths.

Recommendations Update versions 1.2.0 through 1.2.7 to version 1.2.8. Update versions 1.3.0-rc.1 through 1.3.1 to version 1.3.3. Update versions 1.4.0-rc.1 through 1.4.0-rc.2 to version 1.4.0-rc.3.