A crafted OCI image layer can cause the unpack routine of image_rs::stream::unpack::unpack() to create a hardlink that resolves to an absolute path outside the intended destination directory. The code incorrectly uses Path::join on an absolute tar entry path, allowing the hardlink to write attacker‑controlled data to any absolute file on the pod virtual machine. In this context, the workload owner already controls image content, so this flaw is an escape from the image boundary into the pod VM rather than a breach of image trust, but it permits the owner to gain broader VM capabilities and potentially abuse attestation. The vulnerability enables arbitrary file writes and requires only a malicious OCI image layer.

The vulnerability affects the Confidential Containers Guest Components product, specifically the image‑rs module. All releases from version 0.16.0 up to, but not including, 0.20.0 are vulnerable; version 0.20.0 and later contain the fix.

The CVSS score of 6.4 indicates a medium severity. The EPSS score is not provided, and the CVE is not listed in CISA KEV, suggesting no known widespread exploitation yet. The attack vector requires an attacker to supply a malicious OCI image layer, which a workload owner can create. Therefore the threat primarily exists to malicious insiders who control image content, enabling them to write files outside the intended extraction context and potentially gain broader access to the pod virtual machine. While the vulnerability does not affect image trust cross‑boundary, it still permits significant compromise of the VM environment if left unpatched.