EUVD Vulnerability Catalog
EUVD-2026-116144
Severity: CRITICAL
Base Score: 9.2
CVSS Version: 4.0
Vulnerability Description
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
▪
Attack Vector (AV): Local
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): Low
▪
User Interaction (UI): None
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): None
▪
Subsequent Confidentiality Impact (SC): High
▪
Subsequent Integrity Impact (SI): High
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
Docker
References & Advisory Links
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
Docker
EPSS Probability
0
Known Aliases
CVE-2026-112917
Published On
2026-11-03
Last Updated
2026-11-03