containerd EUVD-2026-86486

Exploitation requires the attacker to cause containerd to execute PullImage on a crafted OCI image whose index graph is malformed to force super-linear CPU/memory work - i.e. the attacker must control or poison an image source the node pulls from (rogue/compromised registry, malicious public image, or an attacker-influenced image reference in a multi-tenant or CI environment). It triggers before container start, so no running workload or authentication to containerd itself is needed, but it is limited to environments that pull untrusted images; clusters that only pull trusted first-party images from controlled registries are effectively not exposed. Impact is availability-only: pod scheduling stalls and, at large graph sizes, node/runtime instability - no confidentiality or integrity effect.

This is a genuine but bounded-severity availability issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with impact limited to VA:L (no confidentiality or integrity) drives the 6.9 'MEDIUM' score - the only harm is degraded availability (stalled ContainerCreating, at scale node/runtime instability), never code execution or data exposure. No EPSS score, no CISA KEV entry, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; there is no evidence of active or automatable mass exploitation. The most important nuance the raw CVSS understates is the delivery precondition: although PR:N/UI:N score it as trivially reachable, an attacker must first get the node to pull a maliciously crafted OCI image - i.e. control a registry the victim pulls from, poison an image reference, or otherwise influence PullImage. That real-world gating means impact is realistic mainly in multi-tenant/CI or untrusted-image environments, so prioritize patching where nodes pull images from untrusted or user-supplied sources, and treat it as routine maintenance where all images are first-party and trusted.

An attacker who can influence what image a node pulls (a rogue/compromised registry, a poisoned public image, or a user-supplied image reference in a multi-tenant cluster) publishes an image whose OCI index graph is crafted to explode parsing cost. When containerd runs PullImage before container start, it consumes very high CPU/memory, stalling pods in ContainerCreating and, at larger sizes, destabilizing the node or runtime. No public POC is referenced, but the network attack vector and low complexity make weaponization straightforward once malicious-image delivery is achieved.