Skip to main content
CVE-2025-31133VulnerabilityPublished Updated

Red Hat Security Advisory: container-tools:rhel8 security update

Affects Red Hat container-tools:rhel8Source GCVE Database

0

Mentioned vulnerabilities

Authoritative record:CVE-2025-31133· High 7.3

Not known to be exploited · CVSS 7.3 High : upgrade Red Hat runc to 1.3.3 or 1.2.8 soon.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 4.0 base score
7.3High
How severe the flaw is on the 0–10 CVSS scale.
EPSS
1.2% chance of exploitation in 30 days – higher than 69% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 1.3.3, 1.2.8
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 6 Nov 2025

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade runc to 1.3.3 or 1.2.8; opencontainers/runc to 1.2.8.

Affected software

ProductAffectedFixed in
opencontainersruncAffected
  • <1.2.8
  • >=1.3.0-rc.1 <1.3.3
  • >=1.4.0-rc.1 <=1.4.0-rc.3
Fixed in
  • 1.3.3
  • 1.2.8
GitHubopencontainers/runcpkg:github/opencontainers/runcOther threatsAffected
  • <1.2.8
Fixed in
  • 1.2.8

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released an important security update for the container-tools:rhel8 module that addresses these vulnerabilities. Users should apply the update as soon as possible following the guidance in the Red Hat advisory RHSA-2025:21232 (https://access.redhat.com/errata/RHSA-2025:21232). This update includes fixes for all three CVEs affecting runc. No additional mitigation steps are indicated beyond applying the official update.

Description

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133) * runc: container escape with malicious config due to /dev/console mount and related races (CVE-2025-52565) * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Community reviews

Loading reviews…