In Docker Desktop for Windows using the WSL2 backend on x86-64 architectures, an unprivileged Linux container can bypass the default seccomp restriction on AF VSOCK by using a 32-bit socketcall. This isolation bypass allows the container to access host-facing services and Windows files accessible to the logged-in user. LinuxKit-based backends are not affected by this issue.