CVE-2026-112917
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit…
- Risk score
- 65/100
- CVSS
- 9.2 v4.0
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Docker Desktop for Windows with the WSL2 backend has a vulnerability that allows an unprivileged Linux container to bypass seccomp restrictions, potentially exposing host-facing services and Windows files. An attacker could exploit this to gain access to sensitive data.
- Affected
- {'products': ['Docker Desktop'], 'packages': [], 'versions': ['WSL2 (x86-64) with Docker Desktop 4.97.0 or earlier', 'WSL 3.0.2 or earlier']}
- Fix
- Upgrade to Docker Desktop 4.98.0 or later and WSL 3.0.3 or later
- Exploitation
- No known exploitation
Not confirmed. 4.97.0, 3.0.2 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.2 critical
- On your watchlist: docker
References
Original description
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
Last activity 3 Nov 2026. Patch Forecast updates every hour.