CVE-2019-16884

7.5 highEPSS 4.4%

High (7.5). EPSS 4.4% chance of exploitation in the next 30 days. Fixed in github.com/opencontainers/runc 1.0.0-rc8.0.20190930145003-cad42f6e0932.

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 4.4% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2019-09-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

canonical:ubuntu_linux
docker:docker
fedoraproject:fedora
linuxfoundation:runc
opensuse:leap
redhat:enterprise_linux
redhat:enterprise_linux_eus
redhat:enterprise_linux_server_aus
redhat:enterprise_linux_server_tus
redhat:openshift_container_platform

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-fgv8-vj5c-2ppq	Go	github.com/opencontainers/runc	<1.0.0-rc8.0.20190930145003-cad42f6e0932	1.0.0-rc8.0.20190930145003-cad42f6e0932
GHSA-fgv8-vj5c-2ppq	Go	github.com/opencontainers/selinux	<1.3.1-0.20190929122143-5215b1806f52	1.3.1-0.20190929122143-5215b1806f52
GO-2021-0085	Go	github.com/opencontainers/runc	<1.0.0-rc8.0.20190930145003-cad42f6e0932	1.0.0-rc8.0.20190930145003-cad42f6e0932
GO-2021-0085	Go	github.com/opencontainers/selinux	<1.3.1-0.20190929122143-5215b1806f52	1.3.1-0.20190929122143-5215b1806f52

References

Check your stack JSON