A malicious image can advertise layer DiffIDs from another image while its contents differ from the advertised ones. The affected BuildKit implementations use the advertised DiffIDs to determine cache and snapshot identity without verifying that the actual layer content matches the DiffID, which allows an attacker to inject arbitrary layer data into the cache. If a daemon that shares or persistently stores cache first processes such an image, a later build that consumes the victim image may mount the attacker-controlled layer as part of the build base image. This enables the attacker to run code in the victim build, potentially replacing paths such as /bin/sh, reading secrets that are mounted in the build, altering output artifacts, or causing the build to hang.

All versions of the moby BuildKit daemon prior to the release that contains the vendor‑released fix are affected. The vulnerability also impacts both standard snapshotters and lazy‑pull snapshotters, such as stargz, so any BuildKit instance using either method is at risk.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the lack of these metrics does not preclude exploitation. The attack requires a BuildKit daemon that has access to a malicious image and shares its cache with subsequent builds. By manipulating the DiffIDs, an attacker can cause the BuildKit cache to store malicious content, which is then used as base image layers in later builds, enabling code execution and the ability to read build secrets or alter build outputs.