CVE-2025-64750

MediumCVSS 4.5

Published: 02/12/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

SingularityCE and SingularityPRO are container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions, an attacker can redirect the LSM label write operation to be ineffective. This requires running a malicious container image and controlling the content of a shared mount.

Risk Assessment

Bypassing LSM security mechanisms may allow unauthorized operations within the container, leading to privilege escalation or isolation breach.

Recommendation

Update SingularityCE to version 4.3.5 or later and SingularityPRO to version 4.1.11 or 4.3.5. Avoid running untrusted container images.

Other vulnerabilities in SingularityCE

CVE-2026-47215Medium
In SingularityCE and SingularityPRO prior to 4.4.2 and 4.3.9/4.1.14 respectively, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected.

Original NVD description (English source)

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is ineffective. The attacker must cause the user to run a malicious container image that redirects the mount of /proc to the destination of a shared mount, either known to be configured on the target system, or that will be specified by the user when running the container. The attacker must also control the content of the shared mount, for example through another malicious container which also binds it, or as a user with relevant permissions on the host system it is bound from. This vulnerability is fixed in SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS