CVE-2025-31133Published
runc container escape via "masked path" abuse due to mount race conditions
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-31133 · Microsoft / collected KEV context
cve-program · CVE-2025-31133
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522
- https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66
- https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
euvd · EUVD-2025-37945
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522
- https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66
- https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
nvd · CVE-2025-31133
- https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522
- https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66
- https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
osv · GHSA-9493-h29p-rfm2
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://nvd.nist.gov/vuln/detail/CVE-2025-31133
- https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522
- https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66
- https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc
osv · GO-2025-4096
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522
- https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66
- https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
Related operational evidence
Explicit CVE identifiers- runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the sourc… · Advisory content revised · 9 Nov 2026
- Release 2025-10-12 · Tool release · 17 Oct 2025