An flaw in the crun container runtime’s exec command incorrectly interprets the user option –u/--user, causing the value "1" to be treated as UID 0 rather than UID 1. The result is that a process started inside a container runs with full root privileges. This is an example of CWE‑115 (incorrect validation of input) and CWE‑269 (identity confusion).

The vulnerability affects crun, the open‑source OCI container runtime from the Crun Project, in releases 1.19 through 1.26. Version 1.27 and later contain the fix.

The EPSS score is below 1% and the flaw is not listed in CISA’s KEV catalog, suggesting few observed exploits to date. Nonetheless, the potential impact is severe because privilege escalation from a non‑root container process to UID 0 can compromise the host. The attack is likely local; any user able to invoke crun exec with the erroneous -u option can exploit it. If the runtime is accessible from untrusted networks, the risk grows. Applying the patched release or disabling the errant option removes the threat.