Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:NSummary
CVE-2024-40635 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Linuxfoundation Containerd. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-40635 is an integer overflow vulnerability (CWE-190) in containerd, an open-source container runtime. It affects versions prior to 1.6.38, 1.7.27, and 2.0.4. The flaw occurs when containers are launched with a User specified as a UID:GID larger than the maximum 32-bit signed integer, triggering an overflow that causes the container to run as root (UID 0) rather than the intended non-root user, leading to unexpected privilege escalation behavior in environments enforcing non-root execution.
Exploitation requires local access (AV:L), low complexity (AC:L), and high privileges (PR:H), with no user interaction needed (UI:N). A privileged local attacker can import and launch a container image with an oversized UID:GID value, causing the overflow and allowing the container to execute with root privileges. This achieves low confidentiality and integrity impacts (C:L/I:L/A:N) but in a changed scope (S:C), as scored at CVSS 4.6 (CVSS:3.1).
Patches addressing the issue are available in containerd commits 05044ec0a9a75232cad458027ca83437aae3f4da, 1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20, and cf158e884cfe4812a6c371b59e4ea9bc4c46e51a, fixing the vulnerability in versions 1.6.38, 1.7.27, and 2.0.4. The containerd security advisory GHSA-265r-hfxg-fhmg details the issue, recommending upgrades. As a workaround, use only trusted images and limit image import permissions to trusted users. A Debian LTS announcement provides additional distribution-specific guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6529
Vulnerability Data
containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow…
more
condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds integer overflow defects before deployment.
Secure engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer overflow during calculation.
Input validation enforces bounds on values before arithmetic, stopping the conditions that trigger overflow or wraparound.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect integer overflows before release.
Secure SDLC mandates input validation and arithmetic checks that prevent integer overflows.
Application security requirements include bounds checking and safe arithmetic to avoid overflow conditions.
Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.
Secure coding standards explicitly forbid unsafe integer operations and mandate overflow-safe constructs.