Hackers Abuse runc Tool to Escape Containers and Compromise Hosts

Three critical vulnerabilities in runc, the container runtime that powers Docker and Kubernetes, have been disclosed, enabling attackers to break out of container isolation and gain root access to host systems, according to a SUSE researcher. The flaws are CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, with details released on 5 November 2025.

CVE-2025-31133 targets the maskedPaths feature and can permit writes to sensitive host files like /proc/sys/kernel/core_pattern by replacing /dev/null with a symlink during container creation, while CVE-2025-52565 exploits insufficient validation during mounting of /dev/pts/$n to /dev/console, allowing unauthorized write access to protected procfs files; CVE-2025-52881 uses race conditions with shared mounts to redirect runc writes to /proc files, potentially crashing systems or enabling container escape.

Affected and fixed versions are listed as follows: CVE-2025-31133 affects all known versions and is fixed in 1.2.8, 1.3.3, 1.4.0-rc.3+; CVE-2025-52565 affects 1.0.0-rc3 and later and is fixed in 1.2.8, 1.3.3, 1.4.0-rc.3+; CVE-2025-52881 affects all known versions and is fixed in 1.2.8, 1.. Follow us on Google News, LinkedIn, and X for updates, according to GBHackers On Security.