awesome-vm-escape

A curated collection of writeups, exploits, and resources related to virtual machine escape and container breakout.

Contributions are welcome — feel free to open an issue or pull request.

In computer security, virtual machine escape is the process of breaking out of a virtual machine and interacting with the host operating system.

Table of Contents

• VMware / ESXi / Fusion
• VirtualBox
• QEMU
• Parallels Desktop
• Hyper-V
• Docker / Container
• Xen
• CTFs
• Misc

---

VMware / ESXi / Fusion

• VMware Escape Exploit - CVE-2017-4901
• 利用一个堆溢出漏洞实现 VMware 逃逸 - CVE-2017-4901
• A Bunch of Red Pills: VMware Escapes (Keen Lab)
• The Great Escapes of VMware: A Retrospective Case Study of G2H Escape Vulnerabilities (Black Hat EU 2017)
• VMware Exploitation - Resource List
• QEMU-KVM 和 ESXi 虚拟机逃逸实例分享 - 360 Vulcan Team
• CVE-2022-31705: GeekPwn 2022 VMware EHCI OOB
• Bugs of Yore: A Bug Hunting Journey on VMware's Hypervisor (Black Hat USA 2024)
• On the Clock: Escaping VMware Workstation at Pwn2Own Berlin 2025 - PVSCSI Heap Overflow (Synacktiv)
• The Great VM Escape - ESXicape: CVE-2025-22224/22225/22226 Exploit Chain (Huntress)

VirtualBox

Background

• VirtualBox Technical Background

Writeup and Exploit

• VirtualBox E1000 Guest-to-Host Escape
• Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape
• VirtualBox 5.2.6.r120293 - VM Escape
• Thinking Outside the VirtualBox - Pwn2Own 2018 漏洞分析
• Escaping VirtualBox 6.1
• Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991 - VGA & TPM OOB (Pwn2Own 2023)
• CVE-2024-21115: An Oracle VirtualBox LPE Used to Win Pwn2Own (ZDI)

QEMU

• VM Escape - QEMU Case Study (Phrack)
• QEMU Escape Analysis - CVE-2015-7504 and CVE-2015-7512
• QEMU Escape Exploits Collection
• CVE-2020-14364 QEMU 逃逸漏洞分析
• QEMU-KVM 和 ESXi 虚拟机逃逸实例分享 - 360 Vulcan Team
• Resurrecting Zombies: DMA Reentrancy in QEMU (HITB 2023)
• From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow (OtterSec) | Exploit

Parallels Desktop

• Advanced Exploitation of Simple Bugs - A Parallels Desktop Case Study (Pwn2Own 2021)
• CVE-2023-27326: Parallels Desktop Toolgate Vulnerability

Hyper-V

• Awesome Hyper-V Exploitation - Resource List
• CVE-2023-36427: Windows Hyper-V Elevation of Privilege Vulnerability
• CVE-2025-21333: Hyper-V NT Kernel Integration VSP Heap Overflow - SYSTEM Privilege Escalation
• CVE-2025-48822: Hyper-V DDA (Discrete Device Assignment) OOB Read - Local Code Execution

Docker / Container

Background

• Vulnerability Exploitation in Docker Container Environments (Black Hat EU 2015)
• Docker Escape Technology (CanSecWest 2016)

Writeup and Exploit

• Docker 容器逃逸案例分析
• Escaping Docker Container Using waitid - CVE-2017-5123
• Leaky Vessels: CVE-2024-21626 runc Container Breakout (Snyk) | Wiz Deep Dive | Static Detector
• runc Container Breakout via Mount Race Conditions - CVE-2025-31133/52565/52881 (CNCF) | Sysdig Analysis | runc Advisory
• NVIDIAScape: CVE-2025-23266 Three-Line Container Escape in NVIDIA Container Toolkit (Wiz)
• NVIDIA Container Toolkit CVE-2024-0132 Container Escape Deep Dive (Wiz)

Tools

• CDK - Zero Dependency Container Penetration Toolkit

Xen

• Xen Hypervisor VM Escape (HITB 2016)

CTFs

• RealWorld CTF - state-of-the-art_vm
• HITB 2017 - babyqemu
• 0CTF 2017 - QEMU Escape
• 48 小时逃逸 VirtualBox 虚拟机 - 记一次 CTF 中的 0day 之旅
• RWCTF 3rd - BoxEscape (VirtualBox 6.1)

Misc

• Google Group: vmkernelnewbies