This advisory covers multiple security fixes for Red Hat container-related packages such as buildah, crun, podman, runc, and skopeo. Key vulnerabilities include three container escape flaws in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) caused by mount race conditions, malicious configuration involving /dev/console mounts, and arbitrary write gadgets with procfs write redirects. Other fixes address unbounded memory allocation in golang's archive/tar when parsing GNU sparse maps (CVE-2025-58183), an SSH client panic in golang.org/x/crypto/ssh/agent due to unexpected SSH_AGENT_SUCCESS messages (CVE-2025-47913), and a denial-of-service vulnerability in github.com/sirupsen/logrus triggered by large single-line payloads (CVE-2025-65637). The advisory includes updated packages for Red Hat Enterprise Linux 9.0 and Red Hat OpenShift Container Platform 4.16, among others. Detailed remediation instructions and package versions are provided in the Red Hat advisories RHSA-2026:8325 and RHSA-2026:0418.

The vulnerabilities primarily allow container escape, which could enable an attacker to break out of container isolation and potentially execute code on the host system. Denial-of-service conditions and memory exhaustion are also possible due to unbounded allocations and large payloads. The SSH client panic vulnerability could disrupt SSH agent operations. These issues pose a high security risk to affected systems running vulnerable versions of the container runtime and related tooling.

Red Hat has released official security updates addressing these vulnerabilities. Users should apply the updates provided in Red Hat Security Advisories RHSA-2026:8325 and RHSA-2026:0418 for their respective products and versions. For Red Hat OpenShift Container Platform 4.16, users should upgrade to version 4.16.55 or later using the OpenShift CLI or web console following Red Hat's documented procedures. No additional mitigation steps are required beyond applying these official patches.