VulnerabilityPublished 15 Apr 2026

ZDI-26-260: (0Day) Docker Desktop System Editor Uncontrolled Search Path Element Privilege Escalation Vulnerability

Source Zero Day Initiative

Severity

High

Rated High by Zero Day Initiative

Data as of 26 May 2026, 20:33 UTC

local

What to do

AI-suggested

The advisory recommends restricting interaction with Docker Desktop to reduce exposure. Users should monitor vendor communications for any future updates or patches. Given the prerequisite of prior privileged access, limiting local access and container escape opportunities is critical.

Description

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to escape the container and execute high-privileged code within the Docker Hyper-V VM in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

Impact

Successful exploitation allows an attacker with local access and prior container escape to escalate privileges on the host system, potentially leading to full control of the affected machine. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. However, exploitation requires significant prior access, limiting the attack surface.

Summary

This vulnerability in Docker Desktop enables local attackers who have already escaped the container and gained high-privileged code execution within the Docker Hyper-V VM to escalate privileges further on the host system. The flaw is due to the system/editor endpoint executing a program from an unsecured search path, which can be manipulated to run arbitrary code with the current user's privileges. The Zero Day Initiative assigned a CVSS score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). The vendor has not issued a patch, rejecting the report on the basis that exploitation requires prior privileged access. The advisory recommends restricting interaction with Docker Desktop as the primary mitigation.

References

zerodayinitiative.com/advisories/ZDI-26-260/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 26 May 2026, 20:12 UTC

References

Community reviews

Related threats