A race condition (CWE-367) in the docker cp mount setup allows a malicious container to redirect a bind mount to an arbitrary host path, effectively performing an absolute path traversal (CWE-61). The attacker can overwrite critical host files or cause a denial of service.

The vulnerability affects Docker Engine (Moby) versions prior to 29.5.1 and Docker Daemon 28.5.2 and earlier, as well as Moby Daemon versions before 2.0.0-beta.14.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The issue is not listed in the CISA KEV catalog. The likely attack vector involves a malicious container executing docker cp or similar operations that exploit the race condition; an attacker with container runtime privileges can redirect a bind mount and overwrite host files.