Moby BuildKit CVE-2026-93322

Exploitation requires the attacker to be able to submit an LLB build definition to buildkitd via a build frontend - i.e., access to the BuildKit build API/daemon socket, which the local attack vector (AV:L) reflects. No special product configuration is named in the advisory; the impact is most severe when buildkitd is shared among multiple or untrusted build submitters (multi-tenant build services, shared CI runners), since one crafted definition terminates all concurrent builds on that daemon. The limiting factors are: the attacker must have build-submission access to the daemon (not arbitrary network exposure), and in a single-user local build context the denial of service is self-contained. Patched in BuildKit v0.33.1.

This is a denial-of-service vulnerability (CWE-129, improper validation of array index) in moby/buildkit, with real risk that is moderate and bounded. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) shows a local, low-complexity, unauthenticated attack whose only impact is availability (VA:H; VC:N/VI:N - no confidentiality or integrity loss), consistent with the base score of 6.9 (Medium). No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active or probable near-term exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a crash bug reachable by anyone able to submit a build, with no data compromise. The practical priority depends heavily on deployment model: in single-user local Docker builds the blast radius is self-inflicted, but in shared/multi-tenant BuildKit services one malicious frontend can terminate all concurrent builds, which is where this matters. Note the AV:L designation means exploitation is through the build submission interface (daemon socket/API), not arbitrary network reach; defenders exposing buildkitd to untrusted build submitters should treat it as higher priority.

In a shared or CI/CD BuildKit environment where untrusted users can submit builds, an attacker crafts a malicious LLB (low-level build) definition and submits it through a build frontend. The malformed definition triggers an array-index fault that panics buildkitd, terminating the daemon and interrupting every build running on it. No public exploit code was identified at time of analysis.