Skip to content
THREATWIRE

CVE Tracker

CVE-2019-5736

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the…

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

Vendor
docker
Product
docker
CVSS 3.1
8.6 (high), scored by NVD (primary)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE
CWE-78
Published
2019-02-11
NVD modified
2026-06-17
NVD status
Modified

Not in the CISA KEV catalogue at the last update.

EPSS

98.5% chance of exploitation in the next 30 days (percentile 99th)

FIRST EPSS, updated 17 Oct 2026. About EPSS

CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.

References

Data last updated 18 Oct 2026. Sources: NVD API 2.0, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.