The buildah tool for building OCI and Docker container images on Red Hat Enterprise Linux 9 is affected by two security vulnerabilities. CVE-2025-52881 involves a container escape and denial of service in the runc component due to arbitrary write gadgets and procfs write redirects. CVE-2025-58183 is an unbounded allocation vulnerability in the Go archive/tar package when parsing GNU sparse maps, potentially leading to resource exhaustion. Red Hat has issued an important security update (RHSA-2025:22011) that includes fixes for these issues across multiple architectures and variants of Red Hat Enterprise Linux 9.

Successful exploitation of CVE-2025-52881 could allow an attacker to escape container isolation and potentially execute code on the host system or cause denial of service. CVE-2025-58183 could lead to unbounded memory allocation, resulting in denial of service due to resource exhaustion. These vulnerabilities affect systems using the buildah package for container image building on Red Hat Enterprise Linux 9. No known exploits are reported in the wild at this time.

Red Hat has released updated buildah packages that address these vulnerabilities. Users should apply the security update RHSA-2025:22011 promptly to remediate these issues. Detailed instructions and updated packages are available from Red Hat's official advisory and errata pages. No additional mitigation steps are indicated by the vendor advisory.