CVE-2025-52565: runc Container Escape via Malicious Config and /dev/console Mount
Summary
CVE-2025-52565: runc container escape with malicious config due to /dev/console mount and related races. Affects github.com/opencontainers/runc across 3 version ranges.
>= 1.0.0-rc3, < 1.2.8
>= 1.3.0-rc.1, < 1.3.3
>= 1.4.0-rc.1, < 1.4.0-rc.3
Fixed in 1.2.8, 1.3.3 or 1.4.0-rc.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight container runtime that is part of the Open Container Initiative (OCI). It is responsible for running containers on Linux systems, providing essential functionalities such as process isolation and resource management. The package is widely used in various container orchestration systems like Docker and Kubernetes. However, runc has been found to be vulnerable to a specific attack that allows an attacker to escape the container environment under certain conditions.
Vulnerability Detail
The vulnerability arises from insufficient checks when bind-mounting /dev/pts/$n to /dev/console within the container. An attacker can exploit this flaw to mount paths that should be read-only or masked, potentially leading to a denial of service or a container breakout. This occurs after the pivot_root(2) operation, which means the attacker cannot directly write to host files but can manipulate /proc/sysrq-trigger or /proc/sys/kernel/core_pattern, leading to serious security implications. The vulnerability is exacerbated by the order in which bind-mounts and path restrictions are applied, allowing for unauthorized access to sensitive files.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0-rc3, < 1.2.81.2.8go get github.com/opencontainers/runc@v1.2.8 -
>= 1.3.0-rc.1, < 1.3.31.3.3go get github.com/opencontainers/runc@v1.3.3 -
>= 1.4.0-rc.1, < 1.4.0-rc.31.4.0-rc.3go get github.com/opencontainers/runc@v1.4.0-rc.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider using containers with user namespaces to mitigate the impact of this vulnerability. This configuration can help block unauthorized access to sensitive files by ensuring that the host root user is not mapped into the container's user namespace.
Conclusion
CVE-2025-52565 is a significant vulnerability in runc that can lead to serious security risks if not addressed. Users are encouraged to update to the latest patched versions and implement recommended security practices to mitigate potential impacts.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
CVE-2025-52565 is a vulnerability in runc that allows an attacker to escape the container environment by exploiting the /dev/console mount.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to denial of service or container breakout, allowing attackers to gain unauthorized access to sensitive host files.
The patched versions of runc are 1.2.8, 1.3.3, and 1.4.0-rc.3. It is recommended to update to one of these versions.
It is recommended to use containers with user namespaces and to avoid running untrusted container images from unknown sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
