Vulnerability · Published Nov 3, 2026 · Assigned by Docker

CVE-2026-112917Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

Critical 9.2

In plain English

A critical-severity security flaw in Docker Desktop from Docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.2%top 91.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.

Affected products (as reported)

Vendor	Product	Versions
Docker	Docker Desktop	see references

Weakness: CWE-424 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

References

Docker Desktop release notes release-notes
Microsoft WSL 3.0.3 release notes release-notes
Microsoft WSL kernel 6.18.54.1 dependency release notes release-notes