Runc
This hub aggregates every CVE we track for Runc, a product in the ai ml space. Use it to gauge the current risk picture and drill into individual advisories.
17
CVEs tracked
0
Critical
10
High
0
In CISA KEV
Severity distribution
HIGH10MEDIUM6LOW1
Monthly trend
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
3
0
0
0
0
0
0
0
2024-072026-06
Latest CVEs
The 15 most recently published vulnerabilities affecting Runc.
- CVE-2025-52881runc: LSM labels can be bypassed with malicious config using dummy procfs files7.5
- CVE-2025-52565container escape due to /dev/console mount and related races7.5
- CVE-2025-31133runc container escape via "masked path" abuse due to mount race conditions7.8
- CVE-2024-45310runc can be confused to create empty files/directories on the host3.6
- CVE-2024-21626runc container breakout through process.cwd trickery and leaked fds8.6
- CVE-2023-25809rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc5.0
- CVE-2023-28642AppArmor bypass with symlinked /proc in runc6.1
- CVE-2023-27561runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with ...7.0
- CVE-2022-29162Incorrect Default Permissions in runc5.9
- CVE-2022-24769Default inheritable capabilities for linux container should be empty5.9
- CVE-2021-43784Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration6.0
- CVE-2021-30465runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mo...8.5
- CVE-2019-19921runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers w...7.0
- CVE-2019-16884runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a...7.5
- CVE-2019-5736runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to...8.6
Product normalization is registry-driven with AI assist and human review. How it works