Dangerous runC flaws could allow hackers to escape Docker containers

Three critical vulnerabilities in the runC container runtime (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) can be exploited to bypass container isolation by abusing bind-mounts and symlink/race conditions to write to /proc and other host targets, potentially giving attackers root on the underlying host; patches are available and mitigations include enabling user namespaces and running rootless containers, and there are no confirmed active exploits.