Critical Vulnerabilities in runc Expose Docker and Kubernetes to Container Escape

On November 5, 2025, three severe vulnerabilities in runc, the container runtime utilized by Docker and Kubernetes, were disclosed by SUSE researcher Aleksa Sarai. These vulnerabilities, identified as CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, allow attackers to bypass container isolation and gain root access to host systems. The flaws stem from weaknesses in runc’s handling of mount operations and file protections during container creation, posing significant risks to containerized environments globally.

runc Vulnerability Enables Container Isolation Bypass – Active Exploits PossibleHackers Abuse runc Tool to Escape Containers and Compromise HostsRunc Vulnerabilities Can Be Exploited to Escape ContainersRuntime behind Docker and Kubernetes contains three vulnerabilities

The vulnerabilities exploit race conditions and symbolic link manipulations during the initialization of containers.

Runtime behind Docker and Kubernetes contains three vulnerabilities

• CVE-2025-31133 targets the maskedPaths feature, allowing attackers to replace `/dev/null` with a symbolic link, tricking runc into mounting arbitrary host paths. This enables unauthorized writes to critical files like `/proc/sys/kernel/core_pattern`.

Hackers Abuse runc Tool to Escape Containers and Compromise Hosts

• CVE-2025-52565 exploits insufficient validation during the mounting of `/dev/pts/$n` to `/dev/console`, permitting attackers to redirect mounts before security protections are activated, thus gaining write access to protected procfs files.

Hackers Abuse runc Tool to Escape Containers and Compromise Hosts

• CVE-2025-52881 abuses race conditions with shared mounts, allowing attackers to redirect writes to sensitive `/proc` files, potentially leading to system crashes or privilege escalation.

Hackers Abuse runc Tool to Escape Containers and Compromise Hosts

All three vulnerabilities affect various versions of runc, with patches available in versions 1.2.8, 1.3.3, and 1.4.0-rc.3 and later.

runc Vulnerability Enables Container Isolation Bypass – Active Exploits Possible

Organizations using Docker, Kubernetes, or any services reliant on runc are urged to upgrade to the patched versions immediately. Additionally, container operators should audit their environments for suspicious mount configurations and implement strict image scanning policies to detect malicious Dockerfiles. Monitoring for unusual symlink activity during container startup is also recommended to identify potential exploitation attempts.

runc Vulnerability Enables Container Isolation Bypass – Active Exploits PossibleCritical runC Flaws Expose Docker and Kubernetes to Container Escape, Fixes AvailableRunc Vulnerabilities Can Be Exploited to Escape Containers

The maintainers of runc have emphasized the critical nature of these vulnerabilities, urging rapid updates to mitigate risks. AWS has also issued advisories, noting that while the vulnerabilities are significant, there is currently no evidence of active exploitation in the wild. They recommend enabling user namespaces and running containers in rootless mode to limit potential damage from any successful exploit.

Critical runC Flaws Expose Docker and Kubernetes to Container Escape, Fixes Available

While the vulnerabilities have been acknowledged as serious, some experts, including those from Sysdig, caution that exploiting these flaws is not trivial. Attackers must have the ability to start containers with specific mount options, which may limit the scope of potential attacks. However, the combination of the vulnerabilities' simplicity and the high privileges of runc raises significant security concerns.

runc Vulnerability Enables Container Isolation Bypass – Active Exploits Possible

• “All these vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc’s restrictions for writing to arbitrary /proc files,” — Aleksa Sarai, Senior Software Engineer at SUSE

Runtime bugs break container walls, enabling root on Docker hosts

• “AWS does not consider containers a security boundary, and does not utilize containers to isolate customers from each other,” — AWS Advisory

Critical runC Flaws Expose Docker and Kubernetes to Container Escape, Fixes Available

The disclosure of these vulnerabilities highlights the importance of container runtime security and the necessity for organizations to maintain rapid patching cycles. As containerized applications become increasingly prevalent, ensuring the integrity of the underlying infrastructure is paramount to safeguarding against potential exploits.

runc Vulnerability Enables Container Isolation Bypass – Active Exploits Possible