The vulnerability in runc arises when an image contains a "/dev" symlink. During root file‑system preparation, runc calls os.Remove and os.Symlink with a joined path, allowing the image to cause host files such as ptmx to be deleted or to create hard‑coded symlinks in arbitrary host directories. This flaw oversteps host file‑system boundaries and can overwrite or remove critical files, compromising system integrity. The flaw, classified as CWE‑61, is limited to container images built with runc, and is mitigated by Docker's read‑only top layer, but remains exploitable in other runtimes that directly use runc.

The flaw applies to the opencontainers:runc CLI tool in all releases prior to 1.3.6, 1.4.0‑rc.1, 1.4.0‑rc.12, and 1.5.0‑rc.1. Updating to runc 1.3.6, 1.4.3, 1.5.0, or any later release mitigates the issue.

The CVSS score of 3.3 indicates low severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. The likely attack vector involves embedding a malicious /dev symlink in a container image; exploitation requires that runc perform root file‑system setup. Docker mitigates the flaw by creating a read‑only top‑level layer that hides the malicious symlink, but runtimes that use runc directly remain exposed. The overall risk in environments that run untrusted images under runc without additional isolation is modest but non‑zero.