CVE-2025-24965

Name of the Vulnerable Software and Affected Versions crun versions prior to 1.20

Description Crun is an open source OCI Container Runtime fully written in C. In affected versions, a malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file.

Recommendations To resolve the issue, update to crun version 1.20 or later, as the problem is fixed in this version. There are no known workarounds for this vulnerability. As a temporary workaround, consider restricting the use of the krun handler until a patch is available. Avoid using malicious container images to minimize the risk of exploitation.