VulnerabilityPublished 15 Apr 2026

ZDI-26-258: (0Day) Docker Desktop extension-manager Exposed Dangerous Function Local Privilege Escalation Vulnerability

Source Zero Day Initiative

Severity

High

Rated High by Zero Day Initiative

Data as of 26 May 2026, 20:33 UTC

What to do

AI-suggested

The recommended mitigation is to restrict access and interaction with Docker Desktop to trusted users and environments only. Avoid running untrusted code or containers with elevated privileges to reduce the risk of exploitation.

Description

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop for Windows. An attacker must first obtain the ability to execute high-privileged code within the container in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2.

Impact

Successful exploitation allows a local attacker with high-privileged code execution inside a container to escalate privileges on the host running Docker Desktop for Windows. This can lead to arbitrary code execution with the current user's privileges, potentially compromising the host system. However, exploitation requires prior elevated access within the container, limiting the attack surface.

References

zerodayinitiative.com/advisories/ZDI-26-258/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 26 May 2026, 20:13 UTC

References

Community reviews

Related threats