The flaw arises when containerd misinterprets a numeric User directive that exceeds the 32‑bit integer range as a username. An attacker can craft an image with an "/etc/passwd" file containing a mapping that resolves the oversized numeric string to the root user. Running that image causes the container to start with UID 0, thereby bypassing the Kubernetes runAsNonRoot policy and granting elevated privileges. This leads to privilege escalation when non‑root enforcement is expected.

The flaw affects the containerd container runtime in all versions prior to 1.7.32, 2.0.9, 2.2.4, and 2.3.1. It applies to any deployment that relies on containerd to enforce non‑root execution policies, such as Kubernetes clusters using the runAsNonRoot field.

The flaw permits an attacker to supply a malicious container image that includes an oversized numeric User directive and a crafted "/etc/passwd" mapping that resolves the numeric value to root. When such an image is run under containerd in a Kubernetes cluster that relies on runAsNonRoot enforcement, the container starts with UID 0, giving the attacker elevated privileges. The CVSS score of 7.3 indicates high severity, but the EPSS score of < 1% signals that exploitation is currently unlikely; the vulnerability is not tracked in CISA KEV. Despite the low probability, the potential for privilege escalation makes this a critical concern for environments that mandate non‑root operation.