In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop: before 4.12.0.
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:NDocker Desktop
APPDocker< 4.12.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPEContainer
Related vulnerabilities
CVE-2026-6406HIGH8.8ten sam produkt
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Deskto...
CVE-2026-5843HIGH8.8ten sam produkt
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally impor...
CVE-2026-5817HIGH8.8ten sam produkt
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True w...
CVE-2023-5165HIGH7.1ten sam produkt
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrict...
CVE-2023-0626HIGH8.0ten sam produkt
Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affec...