Vulnerability in Docker Desktop

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.2

[ Description ]Official description

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4310

  Docker Desktop: Vulnerability allows bypassing security measures Translated from German

  Risk highCVE-2026-112917

[ References ]References

• docs.docker.com/desktop/release-notes
• github.com/microsoft/WSL/releases/tag/3.0.3
• github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1