CVE-2025-52565 [High] | Denial of Service in Runc

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

EDB-ID	Source	Kind	Published	Link
—	nvd_ref	exploit_tag		Exploit-DB ↗

EDB-ID

Source

Kind

Published

Link

—

nvd_ref

exploit_tag

Exploit-DB ↗

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.01%	0.53%	+0.52%
2	2025-11-07	—	0.01%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.01%

0.53%

+0.52%

2025-11-07

—

0.01%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
8.4	4.0	HIGH	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X` Click to expand Attack vector (AV:L) Attacker needs local access on the target system. Attack complexity (AC:L) Exploitation conditions are straightforward and stable. Attack requirements (AT:N) No additional preconditions are required beyond normal reachability. Privileges required (PR:N) No privileges are required. User interaction (UI:P) A user has to participate (for example click/open/approve). Vulnerable system confidentiality impact (VC:N) No confidentiality impact on the vulnerable system. Vulnerable system integrity impact (VI:H) High integrity impact on the vulnerable system. Vulnerable system availability impact (VA:N) No availability impact on the vulnerable system. Subsequent system confidentiality impact (SC:H) High confidentiality impact on subsequent systems. Subsequent system integrity impact (SI:H) High integrity impact on subsequent systems. Subsequent system availability impact (SA:H) High availability impact on subsequent systems. Exploit maturity (threat) (E:X) Not defined: no reliable threat intelligence; scoring assumes the worst case (equivalent to Attacked). Confidentiality requirement (CR:X) Not defined: insufficient information; scoring treats this like High (worst case). Integrity requirement (IR:X) Not defined: insufficient information; scoring treats this like High (worst case). Availability requirement (AR:X) Not defined: insufficient information; scoring treats this like High (worst case). Modified attack vector (MAV:X) Not defined: scoring uses the Base Attack Vector (AV). Modified attack complexity (MAC:X) Not defined: scoring uses the Base Attack Complexity (AC). Modified attack requirements (MAT:X) Not defined: scoring uses the Base Attack Requirements (AT). Modified privileges required (MPR:X) Not defined: scoring uses the Base Privileges Required (PR). Modified user interaction (MUI:X) Not defined: scoring uses the Base User Interaction (UI). Modified vulnerable system confidentiality impact (MVC:X) Not defined: scoring uses the Base VC metric. Modified vulnerable system integrity impact (MVI:X) Not defined: scoring uses the Base VI metric. Modified vulnerable system availability impact (MVA:X) Not defined: scoring uses the Base VA metric. Modified subsequent system confidentiality impact (MSC:X) Not defined: scoring uses the Base SC metric. Modified subsequent system integrity impact (MSI:X) Not defined: scoring uses the Base SI metric. Modified subsequent system availability impact (MSA:X) Not defined: scoring uses the Base SA metric. Safety (supplemental) (S:X) Not evaluated. Automatable (supplemental) (AU:X) Not evaluated. Recovery (supplemental) (R:X) Not evaluated. Value density (supplemental) (V:X) Not evaluated. Vulnerability response effort (supplemental) (RE:X) Not evaluated. Provider urgency (supplemental) (U:X) Not evaluated.	—	—	[email protected]
7.5	3.1	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	0.8	6.0	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

8.4

4.0

HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Click to expand

Attack vector (AV:L): Attacker needs local access on the target system.
Attack complexity (AC:L): Exploitation conditions are straightforward and stable.
Attack requirements (AT:N): No additional preconditions are required beyond normal reachability.
Privileges required (PR:N): No privileges are required.
User interaction (UI:P): A user has to participate (for example click/open/approve).
Vulnerable system confidentiality impact (VC:N): No confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:H): High integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:N): No availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:H): High confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:H): High integrity impact on subsequent systems.
Subsequent system availability impact (SA:H): High availability impact on subsequent systems.
Exploit maturity (threat) (E:X): Not defined: no reliable threat intelligence; scoring assumes the worst case (equivalent to Attacked).
Confidentiality requirement (CR:X): Not defined: insufficient information; scoring treats this like High (worst case).
Integrity requirement (IR:X): Not defined: insufficient information; scoring treats this like High (worst case).
Availability requirement (AR:X): Not defined: insufficient information; scoring treats this like High (worst case).
Modified attack vector (MAV:X): Not defined: scoring uses the Base Attack Vector (AV).
Modified attack complexity (MAC:X): Not defined: scoring uses the Base Attack Complexity (AC).
Modified attack requirements (MAT:X): Not defined: scoring uses the Base Attack Requirements (AT).
Modified privileges required (MPR:X): Not defined: scoring uses the Base Privileges Required (PR).
Modified user interaction (MUI:X): Not defined: scoring uses the Base User Interaction (UI).
Modified vulnerable system confidentiality impact (MVC:X): Not defined: scoring uses the Base VC metric.
Modified vulnerable system integrity impact (MVI:X): Not defined: scoring uses the Base VI metric.
Modified vulnerable system availability impact (MVA:X): Not defined: scoring uses the Base VA metric.
Modified subsequent system confidentiality impact (MSC:X): Not defined: scoring uses the Base SC metric.
Modified subsequent system integrity impact (MSI:X): Not defined: scoring uses the Base SI metric.
Modified subsequent system availability impact (MSA:X): Not defined: scoring uses the Base SA metric.
Safety (supplemental) (S:X): Not evaluated.
Automatable (supplemental) (AU:X): Not evaluated.
Recovery (supplemental) (R:X): Not evaluated.
Value density (supplemental) (V:X): Not evaluated.
Vulnerability response effort (supplemental) (RE:X): Not evaluated.
Provider urgency (supplemental) (U:X): Not evaluated.

—

[email protected]

7.5

3.1

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

0.8

6.0

[email protected]

OS Trackers for CVE-2025-52565

vendor	priority	summary	link
`alpine`	—	CVE-2025-52565: 1 source package rows (runc); 46 state rows across 3 repos (3.22-community, 3.23-community, edge-community); fixed 12, open 34.	https://security.alpinelinux.org/vuln/CVE-2025-52565
`debian`	not yet assigned	CVE-2025-52565 not yet assigned priority: Debian including 1 source packages (runc), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 3, resolved 2.	https://security-tracker.debian.org/tracker/CVE-2025-52565
`redhat`	high	—	https://access.redhat.com/security/cve/CVE-2025-52565
`suse`	high	CVE-2025-52565 severity important: SUSE including 462 source package names (2.0.4-5.5.402:podman-4.9.5-150500.3.56.2, 2.0.4-5.5.402:runc-1.3.3-150000.85.1, …), 1553 product×package rows across 278 product lines (Container suse/sl-micro/6.0/baremetal-os-container, Container suse/sl-micro/6.0/base-os-container, … (278 product lines)): Known Not Affected 761, Fixed 554, Known Affected 231, First Fixed 7.	https://www.suse.com/security/cve/CVE-2025-52565/
`ubuntu`	high	CVE-2025-52565 high priority: Ubuntu including 3 source packages (runc, runc-app, runc-stable), 22 status rows across 9 suites (bionic, focal, jammy, noble, plucky, questing, trusty, upstream, xenial): ignored 8, released 8, DNE 6.	https://ubuntu.com/security/CVE-2025-52565

Affected software / configurations for CVE-2025-52565

Vendor	Product	Version	Raw CPE
linuxfoundation	runc	>= 1.0.1, < 1.2.8	cpe:2.3:a:linuxfoundation:runc::::::::
linuxfoundation	runc	>= 1.3.0, < 1.3.3	cpe:2.3:a:linuxfoundation:runc::::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94::::::
linuxfoundation	runc	1.0.0	cpe:2.3:a:linuxfoundation:runc:1.0.0:rc95::::::
linuxfoundation	runc	1.4.0	cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1::::::
linuxfoundation	runc	1.4.0	cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2::::::

References for CVE-2025-52565

URL	Tags
https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4	Patch
https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398	Patch
https://github.com/opencontainers/runc/commit/531ef794e4ecd628006a865ad334a048ee2b4b2e	Patch
https://github.com/opencontainers/runc/commit/9be1dbf4ac67d9840a043ebd2df5c68f36705d1d	Patch
https://github.com/opencontainers/runc/commit/aee7d3fe355dd02939d44155e308ea0052e0d53a	Patch
https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64	Patch
https://github.com/opencontainers/runc/commit/de87203e625cd7a27141fb5f2ad00a320c69c5e8	Patch
https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480	Patch
https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r	Exploit Mitigation Patch Third Party Advisory

URL

CVE-2025-52565 | container escape due to /dev/console mount and related races

Public exploit references (Exploit-DB) for CVE-2025-52565

Exploit prediction scoring system (EPSS) score for CVE-2025-52565

Common vulnerability scoring system (CVSS) metrics for CVE-2025-52565

Weakness enumeration for CVE-2025-52565

GitHub Security Advisory for CVE-2025-52565

OS Trackers for CVE-2025-52565

Affected software / configurations for CVE-2025-52565

References for CVE-2025-52565