Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112917— Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

Quick assessment

Affected
Docker Docker Desktop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在采用 WSL2 后端的 Docker Desktop for Windows 环境中，非特权 Linux 容器可利用 32 位 socketcall 系统调用绕过针对 AF_VSOCK 的默认 seccomp 限制。此漏洞可能导致面向宿主机的服务以及当前登录用户可访问的 Windows 文件被暴露。该问题仅影响 x86-64 架构的 WSL2；基于 LinuxKit 的后端不受影响。该问题仅在 Docker Desktop 4.98.0 或更高版本配合 WSL 3.0.3 或更高版本时才能完全修复；若 Docke

CVSS 9.2 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
Docker Docker Desktop 4.98.0< * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112917

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
Source: CVE Program / CVE List V5
Vulnerability Description
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对候选路径的不恰当保护
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Docker Docker Desktop 4.98.0 ~ * -

II. Public POCs for CVE-2026-112917

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112917

请登录查看更多情报信息。

Other References for CVE-2026-112917 (3)

Same Patch Batch · Docker · 2026-11-03 · 6 CVEs total

CVE-2026-103916 8.4 HIGH Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory
CVE-2026-93325 7.3 HIGH Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx
CVE-2026-121614 7.1 HIGH Docker Sandboxes host Git executes repository-controlled programs
CVE-2026-121541 5.6 MEDIUM Bake filesystem path entitlements approval can be skipped in some multi-target builds
CVE-2026-121542 1.8 LOW Bake filesystem path entitlements approval can be skipped for path using basename prefix

IV. Related Vulnerabilities

Same product: Docker Desktop
Same vendor: Docker
Same weakness: CWE-424