CVE-2025-52881

CVE-2025-52881 is a high-severity vulnerability affecting runc, a CLI tool for container management. An attacker can exploit a race condition in runc versions 1.2.7, 1.3.2, and 1.4.0-rc.2 to misdirect writes to /proc to other procfs files, potentially leading to container escape. This attack can be triggered using shared mounts, including through standard Dockerfile builds with docker buildx build. The vulnerability has a CVSS score of 7.5 (HIGH) due to its high impact on confidentiality, integrity, and availability, requiring low privileges but high attack complexity and user interaction. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating a high level of concern.