BuildKit CVE-2026-93321

Exploitation requires the attacker to be able to submit a build (an LLB definition via a malicious frontend) to a target buildkitd daemon - concretely, access to the BuildKit build-submission interface. No authentication is required once that access exists (PR:N) and no user interaction is needed (UI:N), but the vector is local/adjacent (AV:L), not remote-internet-facing, so the realistic exposure is shared or multi-tenant build infrastructure (hosted/CI build services) where untrusted parties can submit builds. On single-tenant setups where only trusted users submit builds, practical risk is substantially lower. Limiting factors: attacker must reach the daemon's build interface, and impact is limited to availability (crash of the daemon and interruption of in-flight builds) with no persistence, data exposure, or code execution.

This is a denial-of-service vulnerability in moby/buildkit's handling of LLB (Low-Level Build) definitions, mapped to CWE-129 (improper validation of array index). The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scores 6.9 (MEDIUM), with impact confined entirely to availability of the vulnerable system (VA:H) and no confidentiality or integrity impact (VC:N/VI:N) - consistent with a crash/panic rather than data exposure or code execution. No EPSS score, CISA KEV listing, SSVC decision, or public POC is present in the provided data, so exploitation probability cannot be quantified from these sources; based on available signals this is 'no public exploit identified at time of analysis'. NOTE A CONFLICT: the supplied Tag labels this 'Information Disclosure', but the CVSS vector sets VC:N (no confidentiality impact) and VA:H (availability only) and the description describes a daemon panic - the tag appears mislabeled and this is a DoS, not information disclosure. Net assessment: a real but moderate-priority availability issue, not a critical widespread-exploitation threat. The AV:L local-adjacent vector (attacker must be able to submit a build to the daemon) meaningfully limits blast radius versus a fully remote network flaw; prioritize patching on multi-tenant or shared build infrastructure where untrusted parties can submit builds.

An attacker with the ability to submit builds to a shared buildkitd daemon (e.g., a multi-tenant CI/CD system or hosted build service) crafts a malicious frontend that emits a specially formed LLB definition. When buildkitd processes the malformed array index, it panics and terminates, aborting not only the attacker's build but all concurrent builds on that daemon. No public exploit code is identified in the provided data; exploitation requires local/adjacent access to the build submission interface (AV:L) with low complexity.