CVE-2025-52881

Name of the Vulnerable Software and Affected Versions runc version 1.2.7 runc version 1.3.2 runc version 1.4.0-rc.2

Description runc is a CLI tool for spawning and running containers according to the OCI specification. A race condition exists that allows an attacker to trick the tool into misdirecting writes to /proc to other procfs files. This is achieved by using a racing container with shared mounts, which can be triggered via symbolic links in a tmpfs or regular bind-mounts. This attack is also possible using a standard Dockerfile with docker buildx build as it permits parallel execution of containers with custom shared mounts. Exploitation of this issue can impact the confidentiality, integrity, and availability of protected information.

Recommendations Update runc version 1.2.7 to 1.2.8. Update runc version 1.3.2 to 1.3.3. Update runc version 1.4.0-rc.2 to 1.4.0-rc.3.