CVE-2019-5736: OS Command Injection
Last updated 25 August 2025
Other sources
runc has a vulnerability in the usage of system file descriptors that allows for container escape and access to the host filesystem. An attacker can exploit this by convincing users to run malicious or modified containers on their systems.
— Red Hat
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-5736.
What is the affected software?
The affected software includes Docker before version 18.09.2, Linuxfoundation Runc before version 1.0.0-rc6, and other products.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by executing a command as root within one of the affected containers to overwrite the host runc binary and gain root access on the host.
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is critical with a CVSS score of 8.6.
Are there any references related to this vulnerability?
Yes, you can find more information about this vulnerability in the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1520029&action=diff), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1520029&action=edit), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1520030&action=diff).