Vulnerability details

CVE-2026-112917

Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

CVSS 4.0

9.2Critical

Official description

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.

CVSS scores

Score	Version	Source	Vector
9.2Critical	4.0	CVEProject cvelistV5 (CNA) (Docker)	`CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N`

Affected products

Vendor	Product	Versions	Source
No product information recorded.

References and advisories

https://docs.docker.com/desktop/release-notes/#4980 release-notes
https://github.com/microsoft/WSL/releases/tag/3.0.3 release-notes
https://github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1 release-notes

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-03
Last updated: 2026-11-04
State: Published
Assigner (CNA): Docker
Kolun priority: 16 · Low

Exploit prediction (EPSS)

0.18%

Probability of exploitation in 30 days

8.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-424
Improper Protection of Alternate Path