Blog · 2026-11-06 · Gardience Engineering · How we test

Docker Desktop CVE-2026-112917: the fix that takes two updates

Find and fix CVEs across the fleet

Docker Desktop for Windows published a critical fix on November 3, and it comes with a catch: updating Docker Desktop is not enough. CVE-2026-112917 is fully fixed only when Docker Desktop 4.98.0 or later runs on WSL 3.0.3 or later. A machine with the new Docker Desktop on an older WSL is still affected, while every inventory says Docker is current.

Docker rates it 9.2 out of 10 (CVSS 4.0, critical).

Docker Desktop on Windows runs containers inside WSL 2, the Linux layer built into Windows. Containers are not supposed to open AF_VSOCK sockets, the channel between that Linux layer and Windows, and Docker's default seccomp filter blocks them. The bug is a second way in: an unprivileged Linux container can open one through the 32-bit socketcall system call, which the filter does not cover.

From there, the container can reach services on the Windows host and Windows files the logged-in user can access. On a developer laptop, that is usually source code, credentials, and SSH keys.

• Affected: Docker Desktop for Windows using the WSL2 backend, on x86-64. That is the default setup on most developer machines.
• Not affected: Docker Desktop's LinuxKit-based backends, Docker Engine on Linux servers, and Docker Desktop on Mac.
• Highest risk: machines that run containers from images you did not build, such as public images, CI jobs, and anything pulled to try out.

It is not in CISA's Known Exploited Vulnerabilities catalog (catalog of November 4), and no attacks have been reported.

On each machine:

wsl --update
wsl --version          # the first line must say WSL version 3.0.3 or later

Then update Docker Desktop and confirm Settings > About shows 4.98.0 or later.

Many Windows patch tools update third-party apps from the public winget catalog. As of November 6, that catalog has Docker Desktop 4.98.0 but its newest WSL is 2.7.14. So a winget-based process updates Docker Desktop, reports the machine current, and leaves it vulnerable. WSL 3.0.3 has been a regular (not preview) release on Microsoft's WSL GitHub page since October 9; it just has not reached winget yet.

The same goes for us: Gardience's App updates checks every Windows machine against the winget catalog, so it finds and updates Docker Desktop across the fleet with approval, but it cannot bring WSL to 3.0.3 until winget has it. Until then, run wsl --update on each machine, and check wsl --version afterward.

Developer laptops are also the machines most often left out of the server patch cycle: they have admin rights, they run code from everywhere, and nobody owns their updates. If your inventory does not include them, start there.

Not as of November 6. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public exploit has been reported.

Only if WSL is 3.0.3 or later too. Run wsl --version on the machine. If the first line says 2.x, the machine is still affected.

Not for this bug. It is specific to Docker Desktop for Windows with the WSL2 backend.

Sources: the CVE record, Docker Desktop 4.98.0 release notes, WSL 3.0.3, CISA KEV catalog.