CVE-2024-21626High· 8.6▾ MidnightPoC availablerunc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 3.8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
18%
20 GitHub repos · Metasploit ×1
Last analysed / modified upstream
18% → 19%
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
runc < 1.1.12fedora = 39Upgrade past the affected range:
runc 1.1.12Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-32221Critical· 9.8When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PU…
CVE-2025-52881High· 7.5runc is a CLI tool for spawning and running containers according to the OCI specification
CVE-2025-31133High· 7.8runc is a CLI tool for spawning and running containers according to the OCI specification
CVE-2026-106561Medium· 5.0Backstage is an open framework for building developer portals
CVE-2026-106501Critical· 9.6Backstage is an open framework for building developer portals
CVE-2026-106459High· 8.5Backstage is an open framework for building developer portals