This vulnerability in Docker Desktop enables local attackers who have already escaped the container and gained high-privileged code execution within the Docker Hyper-V VM to escalate privileges further on the host system. The flaw is due to the system/editor endpoint executing a program from an unsecured search path, which can be manipulated to run arbitrary code with the current user's privileges. The Zero Day Initiative assigned a CVSS score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). The vendor has not issued a patch, rejecting the report on the basis that exploitation requires prior privileged access. The advisory recommends restricting interaction with Docker Desktop as the primary mitigation.

Successful exploitation allows an attacker with local access and prior container escape to escalate privileges on the host system, potentially leading to full control of the affected machine. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. However, exploitation requires significant prior access, limiting the attack surface.

No official patch or fix is currently available as the vendor rejected the report. The advisory recommends restricting interaction with Docker Desktop to reduce exposure. Users should monitor vendor communications for any future updates or patches. Given the prerequisite of prior privileged access, limiting local access and container escape opportunities is critical.