[Under Evaluation - CVE-2026-53488, CVE-2026-50195, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262]: In containerd CRI plugin versions 1.7-2.3, image configuration LABEL instructions are propagated to containers without sanitization, allowing arbitrary host command execution via a crafted container image. This issue does not require checkpoint/restore. Upgrade to a vendor-fixed containerd build for affected platforms (EKS/ECS/Fargate/Bottlerocket/Amazon Linux).