CVE-2025-31133, CVE-2025-52565, CVE-2025-52881 - runc container issues

unknownCVE-2025-31133 CVE-2025-52565 CVE-2025-52881

Bulletin ID: AWS-2025-024 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/11/5 8:45 PM PDT CVE Identifiers: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881 AWS is aware of recently disclosed security issues affecting the runc component of several open source container management systems (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) when launching new containers. AWS does not consider containers a security boundary, and does not utilize containers to isolate customers from each other. There is no cross-customer risk from these issues. AWS customers that utilize containers to isolate workloads within their own self-managed environments are strongly encouraged to contact their operating system vendor for any updates or instructions necessary to mitigate any potential concerns arising from these issues. With the exception of the AWS services listed below, no customer action is required to address this issue. As a best practice, AWS always recommends that you apply all security patches and software version updates. Affected services: Amazon Linux Bottlerocket Amazon Elastic Container Service (ECS) Amazon Elastic Kubernetes Service (EKS) AWS Elastic Beanstalk Finch AWS Deep Learning AMI AWS Batch Amazon SageMaker

CSIRTS triage

vendor: Amazon product: runcOther

What: Security issues in the runc component could affect container management systems.
Who is affected: Customers utilizing containers in self-managed environments.
Urgency: Remediation is encouraged due to potential security risks in container isolation.
Action: Contact the operating system vendor for updates or instructions.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch runc

Get an email when a new runc advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-06-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/aws-2025-024/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-311330.67% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all scored CVEs.
Low exploitation riskCVE-2025-525650.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.
Low exploitation riskCVE-2025-528810.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-31133	coverage & exploitation status	NVD · CVE.org
CVE-2025-52565	coverage & exploitation status	NVD · CVE.org
CVE-2025-52881	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] Red Hat Enterprise Linux (runc): Multiple vulnerabilities allow bypassing of security measurescert-bund