CVE-2026-112917

Name of the Vulnerable Software and Affected Versions Docker Desktop for Windows versions prior to 4.98.0 WSL versions prior to 3.0.3

Description In Docker Desktop for Windows using the WSL2 backend on x86-64 architectures, an unprivileged Linux container can bypass the default seccomp restriction on AF VSOCK by using a 32-bit socketcall. This isolation bypass allows the container to access host-facing services and Windows files accessible to the logged-in user. LinuxKit-based backends are not affected by this issue.

Recommendations Update Docker Desktop to version 4.98.0 or later. Update WSL to version 3.0.3 or later by running wsl --update followed by wsl --shutdown.