awesome-vm-escape [](https://awesome.re)
March 18, 2026 · View on GitHub
A curated collection of writeups, exploits, and resources related to virtual machine escape and container breakout.
Contributions are welcome — feel free to open an issue or pull request.
In computer security, virtual machine escape is the process of breaking out of a virtual machine and interacting with the host operating system.
Table of Contents
VMware / ESXi / Fusion
- VMware Escape Exploit - CVE-2017-4901
- 利用一个堆溢出漏洞实现 VMware 逃逸 - CVE-2017-4901
- A Bunch of Red Pills: VMware Escapes (Keen Lab)
- The Great Escapes of VMware: A Retrospective Case Study of G2H Escape Vulnerabilities (Black Hat EU 2017)
- VMware Exploitation - Resource List
- QEMU-KVM 和 ESXi 虚拟机逃逸实例分享 - 360 Vulcan Team
- CVE-2022-31705: GeekPwn 2022 VMware EHCI OOB
- Bugs of Yore: A Bug Hunting Journey on VMware's Hypervisor (Black Hat USA 2024)
- On the Clock: Escaping VMware Workstation at Pwn2Own Berlin 2025 - PVSCSI Heap Overflow (Synacktiv)
- The Great VM Escape - ESXicape: CVE-2025-22224/22225/22226 Exploit Chain (Huntress)
VirtualBox
Background
Writeup and Exploit
- VirtualBox E1000 Guest-to-Host Escape
- Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape
- VirtualBox 5.2.6.r120293 - VM Escape
- Thinking Outside the VirtualBox - Pwn2Own 2018 漏洞分析
- Escaping VirtualBox 6.1
- Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991 - VGA & TPM OOB (Pwn2Own 2023)
- CVE-2024-21115: An Oracle VirtualBox LPE Used to Win Pwn2Own (ZDI)
QEMU
- VM Escape - QEMU Case Study (Phrack)
- QEMU Escape Analysis - CVE-2015-7504 and CVE-2015-7512
- QEMU Escape Exploits Collection
- CVE-2020-14364 QEMU 逃逸漏洞分析
- QEMU-KVM 和 ESXi 虚拟机逃逸实例分享 - 360 Vulcan Team
- Resurrecting Zombies: DMA Reentrancy in QEMU (HITB 2023)
- From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow (OtterSec) | Exploit
Parallels Desktop
- Advanced Exploitation of Simple Bugs - A Parallels Desktop Case Study (Pwn2Own 2021)
- CVE-2023-27326: Parallels Desktop Toolgate Vulnerability
Hyper-V
- Awesome Hyper-V Exploitation - Resource List
- CVE-2023-36427: Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2025-21333: Hyper-V NT Kernel Integration VSP Heap Overflow - SYSTEM Privilege Escalation
- CVE-2025-48822: Hyper-V DDA (Discrete Device Assignment) OOB Read - Local Code Execution
Docker / Container
Background
- Vulnerability Exploitation in Docker Container Environments (Black Hat EU 2015)
- Docker Escape Technology (CanSecWest 2016)
Writeup and Exploit
- Docker 容器逃逸案例分析
- Escaping Docker Container Using waitid - CVE-2017-5123
- Leaky Vessels: CVE-2024-21626 runc Container Breakout (Snyk) | Wiz Deep Dive | Static Detector
- runc Container Breakout via Mount Race Conditions - CVE-2025-31133/52565/52881 (CNCF) | Sysdig Analysis | runc Advisory
- NVIDIAScape: CVE-2025-23266 Three-Line Container Escape in NVIDIA Container Toolkit (Wiz)
- NVIDIA Container Toolkit CVE-2024-0132 Container Escape Deep Dive (Wiz)
Tools
Xen
CTFs
- RealWorld CTF - state-of-the-art_vm
- HITB 2017 - babyqemu
- 0CTF 2017 - QEMU Escape
- 48 小时逃逸 VirtualBox 虚拟机 - 记一次 CTF 中的 0day 之旅
- RWCTF 3rd - BoxEscape (VirtualBox 6.1)