CVE-2026-112917
Received
Received - Intake
WSL2 Socketcall Bypass in Docker Desktop for Windows
Vulnerability report for CVE-2026-112917, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-03
Last updated on: 2026-11-03
Assigner: Docker Inc.
Description
Description
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| docker | docker_desktop | 4.98.0 |
| docker | wsl | 3.0.3 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-424 | The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources. |
