Dangerous runC flaws could allow hackers to escape Docker containers
Three recently revealed flaws in the runC container runtime, utilized by Docker and Kubernetes, may be exploited to circumvent isolation measures and gain access to the host system.
The security vulnerabilities, identified as CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 (all ), were reported this week by Aleksa Sarai, a software engineer at SUSE and a member of the Open Container Initiative (OCI) board.
runC serves as a universal container runtime and is the OCI's reference implementation for executing containers. It handles low-level tasks such as creating the container process and configuring namespaces, mounts, and cgroups that higher-level tools like Docker and Kubernetes can invoke.
A malicious user taking advantage of the weaknesses could gain write access to the cont...