moby/sys/user CVE-2026-61801

Exploitation requires that the application or runtime uses github.com/moby/sys/user (≤ v0.4.0) to parse a /etc/passwd- or /etc/group-style file whose contents are attacker-influenced - for example, user/group database files packaged inside an untrusted container image processed by containerd/runc, or any service that parses user-supplied user/group files. The crafted file must contain enough entries or oversized numeric UID/GID values to exhaust process memory. Limiting factors: PR:L means the attacker needs some authenticated/privileged ability to introduce the malicious file or image; if the application only ever parses trusted, system-controlled /etc/passwd files, it is effectively not exploitable. No user interaction is needed once the file is submitted for parsing, and impact is confined to availability (process OOM termination) of the parsing process.

This is a moderate-severity, resource-exhaustion DoS (CWE-400) rather than a high-priority remote-code-execution threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) correctly reflects a local attack vector with low privileges required and availability-only impact - no confidentiality or integrity loss. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so by the precision rules this is 'no public exploit identified at time of analysis.' The key nuance is the realistic exploitation path: although AV:L implies local file processing, the related containerd advisory (CVE-2026-47262 / GHSA-jpcc-p29g-p8mq) shows the untrusted files can arrive via container image content, effectively lowering the bar for an attacker who can get a malicious image pulled and processed. Net assessment: a genuine but bounded hardening/patch-management item - worth prioritizing wherever this library parses attacker-influenced user/group databases (container runtimes), but not an emergency given availability-only impact and absence of active-exploitation signals. Note the SSVC framework data (exploitation status, automatable, technical impact) was not supplied, so that dimension cannot be assessed.

An attacker crafts a malicious container image whose /etc/passwd or /etc/group file contains an enormous number of entries (or oversized UID/GID values). When a runtime or application built on github.com/moby/sys/user ≤ v0.4.0 parses that file to resolve a user/group, the unbounded parsing consumes excessive memory and the host process is killed by the OOM killer. No public exploit code was identified, but the containerd advisory documents the container-image path as a practical trigger; AV:L/AC:L means the attack is technically simple once the attacker can influence the parsed file.