products / runc

runc

runc is the OCI reference implementation for spawning and running containers. It is the default low-level runtime used by both Docker Engine and containerd. Container escape vulnerabilities are reported against runc directly, not against the higher-level runtimes that delegate to it. NVD tracks it as linuxfoundation:runc (not opencontainers:runc; the latter has no CPE dictionary entries).

api usage

Querying runc

product slugrunc

version format1.1.11, 1.4.2

bash

curl "https://api.attestd.io/v1/check?product=runc&version=1.1.11" \
  -H "Authorization: Bearer $ATTESTD_KEY"

runc 1.1.11 is affected by CVE-2024-21626, a file descriptor leak that allows a containerized process to escape to the host filesystem. It is on the CISA KEV catalog and was widely exploited in early 2024.

json

{
  "product": "runc",
  "version": "1.1.11",
  "supported": true,
  "risk_state": "low",
  "risk_factors": [
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "1.3.6",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2024-21626",
    "CVE-2024-45310",
    "CVE-2025-31133",
    "CVE-2025-52565",
    "CVE-2025-52881",
    "CVE-2026-41579"
  ],
  "cves": null,
  "max_epss": 0.18087,
  "last_updated": "2026-07-09T00:28:19.148009Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

runc 1.4.2 is past CVE-2024-21626 and other known NVD ranges at last verification; re-run /v1/check after major NVD updates.

bash

curl "https://api.attestd.io/v1/check?product=runc&version=1.4.2" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

runc's CVE history is dominated by container escape vulnerabilities: cases where a process inside a container can reach the host filesystem, process table, or network namespace.

CVE	Description	Affects	CVSS
`CVE-2024-21626`KEV	File descriptor leak via /proc/self/fd allows container escape to host filesystem.	< 1.1.12	8.6
`CVE-2019-5736`	runc binary overwrite via /proc/self/exe from malicious container image.	< 1.0-rc6	8.6
`CVE-2021-30465`	Symlink-exchange race during volume mount allowing container rootfs escape.	< 1.0.0-rc95	7.5
`CVE-2022-29162`	Default seccomp profile did not block clone3 in some configurations.	< 1.1.2	7.8
`CVE-2023-25809`	rootless containers: cgroup file overwrite in some configurations.	< 1.1.5	6.3

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

All products Docker Engine containerd Response Field Reference