CVE-2025-2713: Google Gvisor

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.

Affected products

• Google Gvisor: before 20240325.0 (fixed in 20240325.0)

Published 2025-03-28. Last modified 2026-06-17.