VDB
CVE-2026-64777
CVE-2026-64777
PUBLISHED
CVSS 4.3 MEDIUM
Reported by apple · Published August 20, 2026
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.
Risk Scores
CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | container | 0 |
| Apple | container | 0 |
Timeline
- Aug 20, 2026 CVE Published
- Aug 22, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 27, 2026 CVE Updated
- Aug 28, 2026 EPSS Score
- Sep 3, 2026 Security Advisory
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 17, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score