CVE-2025-47290

A flaw was found in containerd. This vulnerability allows arbitrary modification of the host file system via a time-of-check to time-of-use (TOCTOU) race condition that occurs during image unpacking. Specifically, when pulling and unpacking a specially crafted container image, an attacker could exploit the window between validation and use of file paths to perform unauthorized file system operations on the host. Successful exploitation requires the attacker to supply a malicious image and may require elevated privileges.

The vulnerable component does not affect any product shipped by Red Hat.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.