CVE-2025-52881: runc Container Escape and Denial of Service via Arbitrary Write Gadgets
Summary
CVE-2025-52881: runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects. Affects github.com/opencontainers/runc across 3 version ranges.
< 1.2.8
>= 1.3.0-rc.1, < 1.3.3
>= 1.4.0-rc.1, < 1.4.0-rc.3
Fixed in 1.2.8, 1.3.3 or 1.4.0-rc.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight container runtime that is part of the Open Containers Initiative (OCI). It is responsible for creating and managing containers on a host system, providing essential functionalities such as process isolation, resource management, and security enforcement. runc is widely used in container orchestration systems like Docker and Kubernetes. However, it has been found to be vulnerable to a sophisticated attack that allows an attacker to manipulate writes to the proc filesystem, potentially leading to container escape and denial of service.
Vulnerability Detail
The vulnerability arises from an attack vector similar to CVE-2019-19921, where an attacker can trick runc into misdirecting writes to procfs files. By exploiting shared mounts and racing containers, an attacker can redirect writes intended for procfs to other files, including dangerous ones like /proc/sysrq-trigger, which can crash the host system. This vulnerability affects all known versions of runc and can lead to privilege escalation or denial of service, particularly through misconfigured sysctls.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.2.81.2.8go get github.com/opencontainers/runc@v1.2.8 -
>= 1.3.0-rc.1, < 1.3.31.3.3go get github.com/opencontainers/runc@v1.3.3 -
>= 1.4.0-rc.1, < 1.4.0-rc.31.4.0-rc.3go get github.com/opencontainers/runc@v1.4.0-rc.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid running untrusted container images from unknown or unverified sources. Additionally, consider using rootless containers to limit the impact of this vulnerability, as it restricts the privileges of the runc process.
Conclusion
CVE-2025-52881 presents a significant security risk for users of runc, allowing for potential container escapes and denial of service attacks. It is crucial to update to the patched versions of runc and implement recommended workarounds to mitigate risks. Regular monitoring of vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
CVE-2025-52881 is a vulnerability in runc that allows an attacker to exploit arbitrary write gadgets and misdirect writes to procfs, potentially leading to container escape and denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to privilege escalation, denial of service, and the ability to bypass security mechanisms like AppArmor and SELinux.
If an immediate update is not possible, consider running trusted container images only and using rootless containers to mitigate the risk.
Yes, Vulert monitors and alerts in real-time for open-source vulnerabilities using just Gopkg.lock, making it a valuable tool for maintaining application security.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
