Skip to main content

Containerd CVE-2025-47290

HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2025-05-20 security-advisories@github.com
Information Disclosure Red Hat Suse Containerd
7.6
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat
8.4 HIGH
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:42 vuln.today
Patch released
Mar 28, 2026 - 18:42 nvd
Patch available
CVE Published
May 20, 2025 - 19:15 nvd
HIGH 7.6

DescriptionGitHub Advisory

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

AnalysisAI

containerd is a container runtime. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-367. containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. Affected products include: Linuxfoundation Containerd.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Containerd

View all
CVE-2026-53488 CRITICAL
9.4 Jun 19

Host command execution in containerd's CRI plugin arises because labels from an image config (Dockerfile LABEL instructi
CVE-2026-53492 HIGH
8.4 Jun 19

Kubernetes device-plugin and resource-allocation enforcement can be bypassed in containerd by a namespace user holding p
CVE-2026-53489 HIGH
8.2 Jun 19

Arbitrary host file disclosure in containerd's CRI plugin lets an attacker read any file on the Kubernetes node via `kub
CVE-2026-50195 MEDIUM
5.6 Jun 19

Checkpoint image poisoning in containerd's CRI implementation allows an attacker with pod-creation permissions to corrup
CVE-2026-47262 MEDIUM
5.3 Jun 19

Memory exhaustion via maliciously crafted container image in containerd causes an OOM kill of the containerd process, re
CVE-2024-40635 MEDIUM
4.6 Mar 17

containerd is an open-source container runtime. Rated medium severity (CVSS 4.6), this vulnerability is low attack compl
CVE-2025-64329 MEDIUM
6.9 Nov 07

containerd is an open-source container runtime. Rated medium severity (CVSS 6.9), this vulnerability is no authenticatio
CVE-2024-25621 HIGH
7.3 Nov 06

containerd is an open-source container runtime. Rated high severity (CVSS 7.3), this vulnerability is low attack complex
CVE-2025-47291 MEDIUM
4.6 May 21

containerd is an open-source container runtime. Rated medium severity (CVSS 4.6), this vulnerability is no authenticatio

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-34027 CRITICAL POC
10.0
CVE-2026-25641 CRITICAL POC
10.0
CVE-2025-23359 HIGH POC
8.3
CVE-2026-41651 HIGH POC
8.8
CVE-2026-24071 HIGH POC
7.8
CVE-2026-25728 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Server 16.0 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed

Share

CVE-2025-47290 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy