Filestore.Fortinet

runC Container Escape Vulnerabilities Disclosed

First seen 8 Nov 2025, 12:36 UTC • Ubuntu

•37.6

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

High-severity vulnerabilities in runC (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) were disclosed in early November 2025. These vulnerabilities allow a malicious container to escape its boundary and potentially execute code on the host system, affecting various Linux container stacks that utilize runC. The vulnerabilities involve improper handling of masked paths and bind-mounts.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

17 entities, 34 inferred relationships (STIX 2.1).

Technique (1)

Zero-day Exploit

Organization (2)

AWS
Ubuntu

Vulnerability (4)

CVE-2019-16884
CVE-2025-31133
CVE-2025-52565
CVE-2025-52881

Affected Platform (8)

Amazon Linux
Bottlerocket
Containerd
CRI-O
ECS
Fargate
Kubernetes
Linux

Tool (2)

Docker
Runc

Relationships

Docker exploits CVE-2019-16884
Docker exploits CVE-2025-31133
Docker exploits CVE-2025-52565
Docker exploits CVE-2025-52881
Runc exploits CVE-2019-16884
Runc exploits CVE-2025-31133
Runc exploits CVE-2025-52565
Runc exploits CVE-2025-52881
CVE-2019-16884 targets Amazon Linux
CVE-2019-16884 targets Bottlerocket
CVE-2019-16884 targets Containerd
CVE-2019-16884 targets CRI-O
CVE-2025-31133 targets Amazon Linux
CVE-2025-31133 targets Bottlerocket
CVE-2025-31133 targets Containerd
CVE-2025-31133 targets CRI-O
CVE-2025-52565 targets Amazon Linux
CVE-2025-52565 targets Bottlerocket
CVE-2025-52565 targets Containerd
CVE-2025-52565 targets CRI-O
CVE-2025-52881 targets Amazon Linux
CVE-2025-52881 targets Bottlerocket
CVE-2025-52881 targets Containerd
CVE-2025-52881 targets CRI-O
Zero-day Exploit targets Amazon Linux
Zero-day Exploit targets Bottlerocket
Zero-day Exploit targets Containerd
Zero-day Exploit targets CRI-O
CVE-2019-16884 related to AWS
CVE-2019-16884 related to Ubuntu
CVE-2019-16884 related to ECS
CVE-2019-16884 related to Fargate
CVE-2019-16884 related to Kubernetes
CVE-2019-16884 related to Linux

Continue Reading

Gamaredon Exploits WinRAR Vulnerability in Ongoing Ukraine Campaign Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware Malware Spread via Fake Polymarket Trading Bot Targets DeFi Developers Red Menshen APT Uses BPFdoor for Long-Term Espionage in Telecom Networks APT41 Exploits Cloud Services with New Zero-Detection ELF Backdoor Google and FBI Disrupt NetNut Proxy Network Linked to 2 Million Devices

runC Container Escape Vulnerabilities Disclosed

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading