Projects
View on GitHub awesome-vm-escape
winmin/awesome-vm-escape
winmin/awesome-vm-escape has 621 GitHub stars and 79 forks. GitHot measured 0 stars in 24 hours. Last checked 2026-11-15 11:15 UTC. Last push 2026-03-18.
Measured star growth
- in 24h
- 0
- in 7 days
- Collecting history
- in 15 days
- Collecting history
- in 1 month
- Collecting history
Net star changes over overlapping periods, not daily totals. Missing measurements are left blank. Stars measure attention, not software quality.
About
share some useful archives about vm and qemu escape exploit.
LearningREADME.md
Originalawesome-vm-escape 
A curated collection of writeups, exploits, and resources related to virtual machine escape and container breakout.
Contributions are welcome — feel free to open an issue or pull request.
In computer security, virtual machine escape is the process of breaking out of a virtual machine and interacting with the host operating system.
Table of Contents
VMware / ESXi / Fusion
- VMware Escape Exploit - CVE-2017-4901
- 利用一个堆溢出漏洞实现 VMware 逃逸 - CVE-2017-4901
- A Bunch of Red Pills: VMware Escapes (Keen Lab)
- The Great Escapes of VMware: A Retrospective Case Study of G2H Escape Vulnerabilities (Black Hat EU 2017)
- VMware Exploitation - Resource List
- QEMU-KVM 和 ESXi 虚拟机逃逸实例分享 - 360 Vulcan Team
- CVE-2022-31705: GeekPwn 2022 VMware EHCI OOB
- Bugs of Yore: A Bug Hunting Journey on VMware's Hypervisor (Black Hat USA 2024)
- On the Clock: Escaping VMware Workstation at Pwn2Own Berlin 2025 - PVSCSI Heap Overflow (Synacktiv)
- The Great VM Escape - ESXicape: CVE-2025-22224/22225/22226 Exploit Chain (Huntress)
VirtualBox
Background
Writeup and Exploit
- VirtualBox E1000 Guest-to-Host Escape
- Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape
- VirtualBox 5.2.6.r120293 - VM Escape
- Thinking Outside the VirtualBox - Pwn2Own 2018 漏洞分析
- Escaping VirtualBox 6.1
- Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991 - VGA & TPM OOB (Pwn2Own 2023)
- CVE-2024-21115: An Oracle VirtualBox LPE Used to Win Pwn2Own (ZDI)
QEMU
- VM Escape - QEMU Case Study (Phrack)
- QEMU Escape Analysis - CVE-2015-7504 and CVE-2015-7512
- QEMU Escape Exploits Collection
- CVE-2020-14364 QEMU 逃逸漏洞分析
- QEMU-KVM 和 ESXi 虚拟机逃逸实例分享 - 360 Vulcan Team
- Resurrecting Zombies: DMA Reentrancy in QEMU (HITB 2023)
- From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow (OtterSec) | Exploit
Parallels Desktop
- Advanced Exploitation of Simple Bugs - A Parallels Desktop Case Study (Pwn2Own 2021)
- CVE-2023-27326: Parallels Desktop Toolgate Vulnerability
Hyper-V
- Awesome Hyper-V Exploitation - Resource List
- CVE-2023-36427: Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2025-21333: Hyper-V NT Kernel Integration VSP Heap Overflow - SYSTEM Privilege Escalation
- CVE-2025-48822: Hyper-V DDA (Discrete Device Assignment) OOB Read - Local Code Execution
Docker / Container
Background
- Vulnerability Exploitation in Docker Container Environments (Black Hat EU 2015)
- Docker Escape Technology (CanSecWest 2016)
Writeup and Exploit
- Docker 容器逃逸案例分析
- Escaping Docker Container Using waitid - CVE-2017-5123
- Leaky Vessels: CVE-2024-21626 runc Container Breakout (Snyk) | Wiz Deep Dive | Static Detector
- runc Container Breakout via Mount Race Conditions - CVE-2025-31133/52565/52881 (CNCF) | Sysdig Analysis | runc Advisory
- NVIDIAScape: CVE-2025-23266 Three-Line Container Escape in NVIDIA Container Toolkit (Wiz)
- NVIDIA Container Toolkit CVE-2024-0132 Container Escape Deep Dive (Wiz)
Tools
Xen
CTFs
- RealWorld CTF - state-of-the-art_vm
- HITB 2017 - babyqemu
- 0CTF 2017 - QEMU Escape
- 48 小时逃逸 VirtualBox 虚拟机 - 记一次 CTF 中的 0day 之旅
- RWCTF 3rd - BoxEscape (VirtualBox 6.1)