UpHeron
All vulnerabilities

Servers and applications

CVE-2025-31133

container escape via "masked path" abuse due to mount race conditions

Severity
High 7.3
Published
5 Nov 2025
Last changed
7 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.2.8, 1.3.3
Also known as
GHSA-9493-h29p-rfm2
Sources
NVD, Project advisories (GitHub)

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two…

Affected software

SoftwareAffected versions
runcServers and applications · cpe:a:linuxfoundation:runc
  • Every version before 1.2.8
  • From 1.3.0 before 1.3.3
  • Version 1.4.0-rc1
  • Version 1.4.0-rc2
runcServers and applications · github:opencontainers/runc
  • Every version before 1.2.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-31133
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-31133
  • GitHub Advisory Database https://github.com/advisories/GHSA-9493-h29p-rfm2
  • github.com https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2