---
title: "CVE-2025-52565: container escape due to /dev/console mount and related races"
url: https://erroneo.us/security/cve/CVE-2025-52565/
description: "CVE-2025-52565 (opencontainers runc): runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-11-06
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-52565"
kev: false
cvss: 8.4
epss: 0.00567
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-52565: container escape due to /dev/console mount and related races

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.6% , percentile 46: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 46% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
- Editorial verdict: Patch this week. runc Container Escapes: Three Mount-Race CVEs Fixed — Not remotely exploitable and not seen in attacks, but anyone who runs or builds images they do not fully trust (CI runners, multi-tenant clusters) should roll out patched runc this week.

## What it is

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting /dev/pts/$n to /dev/console inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of /dev/pts/$n to /dev/console as configured for all containers that allocate a console). This happens after pivotroot(2), so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of /proc/sysrq-trigger or /proc/sys/kernel/corepattern (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

## Affected products (CVE record)

- opencontainers runc: >= 1.0.0-rc3, < 1.2.8, >= 1.3.0-rc.1, < 1.3.3, >= 1.4.0-rc.1, < 1.4.0-rc.3

## Severity

- GitHub_M CVSS 4.0: 8.4 `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.57% probability of exploitation activity in the next 30 days; percentile 46.

## Sources

- [CVE.org record CVE-2025-52565](https://www.cve.org/CVERecord?id=CVE-2025-52565)
- [NVD entry CVE-2025-52565](https://nvd.nist.gov/vuln/detail/CVE-2025-52565)
- [github.com](https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r)
- [github.com](https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4)
- [github.com](https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398)
- [github.com](https://github.com/opencontainers/runc/commit/531ef794e4ecd628006a865ad334a048ee2b4b2e)
- [github.com](https://github.com/opencontainers/runc/commit/9be1dbf4ac67d9840a043ebd2df5c68f36705d1d)
- [github.com](https://github.com/opencontainers/runc/commit/aee7d3fe355dd02939d44155e308ea0052e0d53a)
- [github.com](https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64)
- [github.com](https://github.com/opencontainers/runc/commit/de87203e625cd7a27141fb5f2ad00a320c69c5e8)
- [github.com](https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480)

---
Source page: https://erroneo.us/security/cve/CVE-2025-52565/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt