What’s Vulnerable › Products

opencontainers runc vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your opencontainers runc version is affected

Latest opencontainers runc vulnerabilities

• CVE-2026-41579 — runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations (CVSS 3.3)
• CVE-2025-52881 — runc: LSM labels can be bypassed with malicious config using dummy procfs files (CVSS 7.5)
• CVE-2025-52565 — container escape due to /dev/console mount and related races (CVSS 7.5)
• CVE-2025-31133 — runc container escape via "masked path" abuse due to mount race conditions (CVSS 7.8)
• CVE-2024-45310 — runc can be confused to create empty files/directories on the host (CVSS 3.6)
• CVE-2024-21626 — runc container breakout through process.cwd trickery and leaked fds (CVSS 8.6)
• CVE-2023-28642 — AppArmor bypass with symlinked /proc in runc (CVSS 7.8)
• CVE-2023-25809 — rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc (CVSS 6.3)
• CVE-2023-27561 — (CVSS 7.0)
• CVE-2022-29162 — Incorrect Default Permissions in runc (CVSS 7.8)
• CVE-2022-24769 — Default inheritable capabilities for linux container should be empty (CVSS 5.9)
• CVE-2021-43784 — Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVSS 5.0)
• CVE-2021-30465 — (CVSS 8.5)
• CVE-2019-19921 — (CVSS 7.0)
• CVE-2019-16884 — (CVSS 7.5)
• CVE-2019-5736 — (CVSS 8.6)
• CVE-2016-3697 — (CVSS 7.8)