gVisor vulnerabilities

3 known vulnerabilities in gVisor from Google. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  gVisor: Double Free

  CVE-2026-95702Oct 9, 2026Google

  Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an i

• 8.8 High severity

  gVisor: Improper Privilege Management

  CVE-2026-96812Sep 25, 2026Google

  Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution

• 7.8 High severity

  gVisor: Incorrect Privilege Assignment

  CVE-2025-2713Mar 28, 2025Google

  Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-li