What is CVE-2026-112917 in Docker Desktop?

CVE-2026-112917 is a critical vulnerability carrying a CVSS score of 9.2 that impacts Docker Desktop for Windows when running on the WSL2 backend. In this environment, an unprivileged Linux container can leverage a 32-bit socketcall to bypass default seccomp security restrictions governing AF_VSOCK. This unexpected behavior introduces serious risks, potentially exposing host-facing services and sensitive Windows files accessible to the currently logged-in user. You can review additional security context through our articles covering CVE-2026-58946 de escalada de privilegios and CVE-2026-58957 en ActivityStarter.java.

The underlying problem specifically affects x86-64 architectures utilizing WSL2. It is worth noting that alternative environments, such as LinuxKit-based backends, remain entirely unaffected by this flaw. Furthermore, similar risks are analyzed in reports like la vulnerabilidad Use-After-Free CVE-2026-59044 for local privilege escalation.

Who is affected by this container escape vulnerability?

The security flaw specifically impacts Windows environments where Docker Desktop operates alongside the WSL2 integration layer. Unprivileged local attackers or compromised container workloads can exploit this mechanism to break container isolation boundaries and interact with host-bound resources.

Official documentation and safety advisories are tracked via the [[https://nvd.nist.gov/vuln/detail/CVE-2026-112917|NIST NVD database]] and the [[https://www.cve.org/CVERecord?id=CVE-2026-112917|CVE.org entry]] for standardized vulnerability tracking.

How do I protect my system and apply patches?

Mitigating this vulnerability requires updating both components of your local development environment simultaneously, as updating only one leaves the system vulnerable. Running Docker Desktop 4.98.0 or later on an older version of WSL will still leave the host exposed to potential attacks.

You can verify and download the necessary updates directly from the official repositories using [[https://docs.docker.com/desktop/release-notes/#4980|Docker release notes]], the [[https://github.com/microsoft/WSL/releases/tag/3.0.3|WSL releases page]], and the [[https://github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1|WSL Linux Kernel release page]].

How do I secure my environment against the vulnerability?

Follow these step-by-step instructions to secure your development workstation against CVE-2026-112917:

  1. Open an administrative command prompt or PowerShell terminal on your Windows host.
  2. Run the command to update WSL to version 3.0.3 or later using the command line interface.
  3. Download and install Docker Desktop version 4.98.0 or later from the official sources.
  4. Restart your Windows machine to ensure both WSL2 and Docker Desktop services initialize with the patched binaries.