CVE-2016-3697

7.8 highEPSS 0.4%

High (7.8). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/opencontainers/runc 0.1.0.

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2016-06-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

docker:docker
linuxfoundation:runc
opensuse:opensuse

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-q3j5-32m5-58c2	Go	github.com/opencontainers/runc	<0.1.0	0.1.0
GO-2021-0070	Go	github.com/opencontainers/runc	<0.1.0	0.1.0

References

http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html
http://rhn.redhat.com/errata/RHSA-2016-1034.html
http://rhn.redhat.com/errata/RHSA-2016-2634.html
https://github.com/docker/docker/issues/21436
https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091

Check your stack JSON