UpHeron
All vulnerabilities

Servers and applications

CVE-2025-52565

container escape with malicious config due to /dev/console mount and related races

Severity
High 8.4
Published
5 Nov 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.2.8, 1.3.3
Also known as
GHSA-qw9x-cqr3-wc7r
Sources
NVD, Project advisories (GitHub)

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a…

Affected software

SoftwareAffected versions
runcServers and applications · cpe:a:linuxfoundation:runc
  • Version 1.4.0-rc2
  • Version 1.4.0-rc1
  • From 1.3.0 before 1.3.3
  • From 1.0.1 before 1.2.8
All 17 release lines
  • Version 1.0.0-rc3
  • Version 1.0.0-rc4
  • Version 1.0.0-rc5
  • Version 1.0.0-rc6
  • Version 1.0.0-rc7
  • Version 1.0.0-rc8
  • Version 1.0.0-rc9
  • Version 1.0.0-rc90
  • Version 1.0.0-rc91
  • Version 1.0.0-rc92
  • Version 1.0.0-rc93
  • Version 1.0.0-rc94
  • Version 1.0.0-rc95
  • From 1.0.1 before 1.2.8
  • From 1.3.0 before 1.3.3
  • Version 1.4.0-rc1
  • Version 1.4.0-rc2
runcServers and applications · github:opencontainers/runc
  • From 1.0.0-rc3 before 1.2.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-52565
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-52565
  • GitHub Advisory Database https://github.com/advisories/GHSA-qw9x-cqr3-wc7r
  • github.com https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r