---
title: "CVE-2025-52881: runc: LSM labels can be bypassed with malicious config using dummy procfs files"
url: https://erroneo.us/security/cve/CVE-2025-52881/
description: "CVE-2025-52881 (opencontainers runc): runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-11-06
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-52881"
kev: false
cvss: 7.3
epss: 0.00567
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-52881: runc: LSM labels can be bypassed with malicious config using dummy procfs files

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.6% , percentile 46: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 46% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
- Editorial verdict: Patch this week. runc Container Escapes: Three Mount-Race CVEs Fixed — Not remotely exploitable and not seen in attacks, but anyone who runs or builds images they do not fully trust (CI runners, multi-tenant clusters) should roll out patched runc this week.

## What it is

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

## Affected products (CVE record)

- opencontainers runc: <= 1.2.7, < 1.2.8, <= 1.3.2, < 1.3.3, <= 1.4.0-rc.2, < 1.4.0-rc.3

## Severity

- GitHub_M CVSS 4.0: 7.3 `CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.57% probability of exploitation activity in the next 30 days; percentile 46.

## Sources

- [CVE.org record CVE-2025-52881](https://www.cve.org/CVERecord?id=CVE-2025-52881)
- [NVD entry CVE-2025-52881](https://nvd.nist.gov/vuln/detail/CVE-2025-52881)
- [github.com](https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm)
- [github.com](https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r)
- [github.com](https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2)
- [github.com](https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480)
- [github.com](https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51)
- [github.com](https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1)
- [github.com](https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64)
- [github.com](https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165)
- [github.com](https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2)
- [github.com](https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28)
- [github.com](https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db)
- [github.com](https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544)
- [github.com](https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f)
- [github.com](https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6)
- [github.com](https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58)
- [github.com](https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d)
- [github.com](https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557)
- [github.com](https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md)
- [github.com](http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322)
- [github.com](http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3)

---
Source page: https://erroneo.us/security/cve/CVE-2025-52881/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt