BuildKit EUVD-2026-92534

Exploitation requires the BuildKit daemon to process a build that uses an attacker-controlled external frontend, which then issues crafted requests over the internal daemon API to provoke the data race. The key limiting factors are: the operator must opt into running an untrusted/malicious frontend (e.g., a `

syntax=` reference to an attacker image), the attacker needs low-level privileges (PR:L) via that frontend channel rather than unauthenticated remote access, access is local (AV:L), and success is timing-dependent (AT:P) because it relies on winning a race condition. Default builds using trusted first-party frontends are not exposed.

This is a medium-severity denial-of-service issue, not a high-priority emergency. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) and impact metrics (VC:N/VI:N/VA:H) are internally consistent: the only consequence is availability loss (a BuildKit daemon panic) via a data race, with no confidentiality or integrity impact. Several signals lower the real-world risk: exploitation is local with low privileges required (PR:L), it carries an attack requirement (AT:P) reflecting the timing-dependent nature of the race condition, and it depends on the victim choosing to run an attacker-controlled frontend. No KEV listing is present, no public POC is indicated, and no EPSS score was provided, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' CONFLICT TO NOTE: the input Tags label this 'Information Disclosure,' but both the description (daemon panic) and the CVSS vector (VC:N, VA:H) describe a denial of service, not disclosure - the tag appears mislabeled and should not drive triage. Net: a genuine but contained DoS affecting build pipelines that consume untrusted frontends, not a drop-everything flaw.

An attacker publishes a malicious BuildKit frontend image; a developer or CI pipeline references it (e.g., via a `

syntax=` directive) and runs a build. The malicious frontend abuses the internal daemon API to create a data race that panics the BuildKit daemon, disrupting the build service. No public exploit code has been identified at time of analysis.