Containerd is an open‑source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4, and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32‑bit integer are incorrectly treated as a username, leading supplies an /etc/passwd file mapping an oversized numeric value to root causes the container to run as UID 0, thereby bypassing Kubernetes runAsNonRoot restrictions and allowing containers to execute with elevated privileges in environments that require non‑root execution.

The flaw affects the containerd container runtime in all versions prior to 1.7.32, 2.0.9, 2.2.4, and 2.3.1. It applies to any deployment that relies on containerd to enforce non‑root execution policies, such as Kubernetes clusters using the runAsNonRoot field.

Based image that includes a specially crafted /etc/passwd file mapping an oversized numeric value to the root user. With a CVSS score of 7.3, the vulnerability poses a significant risk. The EPSS score indicates a low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog. Deploying a crafted image in the target environment, especially where custom images are allowed or image validation is insufficient, makes this vulnerability relevant.