The runC tool, a lightweight container runtime implementation of the Open Container Format, contains three notable security flaws: CVE-2025-31133 involves container escape via 'masked path' abuse due to mount race conditions; CVE-2025-52565 involves container escape through malicious configuration exploiting /dev/console mount and related race conditions; CVE-2025-52881 involves container escape and denial of service caused by arbitrary write gadgets and procfs write redirects. These vulnerabilities allow an attacker to escape container isolation and potentially cause denial of service. The issues affect Red Hat Enterprise Linux 9 versions prior to 9.8 and specific runC package versions. Red Hat has released updated packages to remediate these vulnerabilities as detailed in advisory RHSA-2025:20957.

Successful exploitation of these vulnerabilities could allow an attacker to escape container isolation, potentially gaining unauthorized access to the host system or other containers. Additionally, one vulnerability can cause denial of service. These impacts compromise container security boundaries and system stability.

Red Hat has released updated runC packages addressing these vulnerabilities. Users should apply the security update described in advisory RHSA-2025:20957 promptly to remediate the issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No indication of active exploitation in the wild has been reported. Applying the official patches is the recommended mitigation.