CVE-2026-79699

MediumCVSS 4.4

Published: 15/09/2026(UTC)Updated: 02/10/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Risk Assessment

An attacker could cause the extraction destination directory to be replaced with an arbitrary file, potentially damaging data or affecting filesystem integrity. The risk applies to environments processing untrusted container image layers.

Recommendation

Update the containers/storage library to a version containing the fix. Avoid processing untrusted tar archives and image layers without verification.

Other vulnerabilities in containers/storage

CVE-2024-9676Medium
A symlink traversal vulnerability in the containers/storage library affects Podman, Buildah, and CRI-O. When running a malicious image with an automatically assigned user namespace (--userns=auto), the library reads /etc/passwd inside the container without validating whether it is a symlink, potentially causing the library to read an arbitrary file on the host and leading to a hang and denial of service via OOM kill.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS