Runc Vulnerabilities Can Be Exploited to Escape Containers

Several vulnerabilities in the Runc container runtime, tracked as CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, can be exploited to escape containers and gain root access to the host system. Runc is the low-level tool used for creating and running containers, and the flaws can be exploited via malicious containers, with attacks relying on starting containers with custom mount configurations.

The CVSS score for all three flaws is 4.0, placing them in the medium severity category, though researchers note the severity would be higher from the perspective of network-enabled systems like Docker or Kubernetes. While there is no evidence of in-the-wild exploitation, security companies such as Sysdig have added exploitation detections to their products.

Runc updates that patch the vulnerabilities have been released, and according to Red Hat and AWS advisories, vendors notified affected customers ahead of public disclosure.