CVE-2026-41579: runc before 1.3.6 (exclusive), from 1.4.0 (inclusive), before 1.4.3 (exclusive), 1.5.0 · update rc1 (+2 more affected…

Affected technology

runc · before 1.3.6 (exclusive)
linuxfoundation

runc · from 1.4.0 (inclusive), before 1.4.3 (exclusive)
linuxfoundation

runc · 1.5.0 · update rc1
linuxfoundation

runc · 1.5.0 · update rc2
linuxfoundation

runc · < 1.3.6, >= 1.4.0-rc.1, < 1.4.3, >= 1.5.0-rc.1, < 1.5.0-rc.3
opencontainers

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 3.3/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.