Search: CVE-2025-31133

CVE-2025-31133 is a vulnerability in the runc container runtime tool where insufficient verification of the source of bind-mounts for /dev/null allows attackers to exploit symbolic link following. This flaw enables arbitrary mount gadget attacks that can lead to host information disclosure, denial of service, container escape, or bypassing of maskedPaths protections. The issue affects specific versions of runc prior to 1.2.8, between 1.3.0-rc.1 and before 1.3.3, and certain 1.4.0 release candidates. It has a high severity rating and a CVSS 4.0 score of 7.3. Fixes are available in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.