CVE-2026-93321: Malformed LLB file operation can crash buildkitd
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
Other sources
Malformed LLB file operation can crash buildkitd
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to trigger the issue?
An attacker needs to operate a malicious frontend that can submit an LLB definition to the BuildKit daemon. The supplied CVSS vector indicates no privileges or user interaction are required, but the attack vector is local.
Which systems are most exposed?
BuildKit daemons that process LLB definitions from untrusted or insufficiently trusted frontends are exposed. A successful attack terminates the daemon and interrupts every build running on that daemon.
How might an active attack appear operationally?
The primary observable symptom is buildkitd panicking and terminating, accompanied by simultaneous interruption of builds running on that daemon.