Moby BuildKit EUVD-2026-92529

Exploitation requires the attacker to control (or compromise) a container registry or OCI-layout blob source that a victim's BuildKit build will fetch from, and the attacker must return blob content whose bytes do not match the claimed content digest. A victim must then actually run a build (UI:A / AT:P) that references and caches that digest, after which later builds reusing the digest-keyed snapshot inherit the poisoned input. Limiting factors: the victim must build against the attacker-influenced source, so trusted/pinned private-registry-only pipelines with verified sources are far less exposed; there is no confidentiality or availability impact, and no privileges are required of the attacker (PR:N) but no fully passive remote trigger exists.

This is a moderate, conditions-dependent integrity flaw rather than a drop-everything emergency. The vendor-assigned CVSS 4.0 score of 5.9 is driven by VI:H (high integrity impact to the vulnerable build) tempered by AT:P (a specific attack requirement) and UI:A (the victim must actively perform a build). There is no confidentiality (VC:N) or availability (VA:N) impact, so the 'Information Disclosure' tag conflicts with the actual integrity/cache-poisoning nature of CWE-354 - treat that tag as unreliable. No EPSS score, no CISA KEV listing, and no POC indicator were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk hinges on whether a victim builds against an attacker-influenced registry or OCI-layout source; in software-supply-chain/CI contexts that is a meaningful threat (poisoned build inputs), but it is not remote-unauthenticated-against-default exploitation. PR:N means no authentication is needed by the attacker, but UI:A plus AT:P substantially narrow real-world opportunity. Net: credible supply-chain integrity concern warranting prompt patching in CI/CD fleets, but not a mass-exploitation-class issue.

An attacker operating or compromising a container registry (or an OCI-layout blob source referenced by a build) serves blob contents that do not match the claimed digest. BuildKit caches the resulting snapshot keyed by that digest, so a later victim build that references the same digest silently reuses the poisoned snapshot, corrupting its build inputs. No public exploit code was identified; exploitation requires the victim to actually run an affected build against the attacker-influenced source (UI:A, AT:P).