Read the docs
TI-2025-02823 Aliases CVE-2025-3224GHSA-6233-jj46-vp44

Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion

Priority HIGH 67CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts to delete files and subdirectories under the path C:\ProgramData\Docker\config with high privileges. However, this directory often does not exist by default, and C:\ProgramData\ allows normal users to create new directories. By creating a malicious Docker\config folder structure at this location, an attacker can force the privileged update process to delete or manipulate arbitrary system files, leading to Elevation of Privilege.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed Docker Desktop (Docker): 4.41.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DockerDocker Desktopbefore 4.41.04.41.0Patch availableCNA
  • Docker Desktop VendorDocker Affected before 4.41.0 Fixed in 4.41.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:docker:desktop:*:*:*:*:*:windows:*:*before 4.41.0VulnerableDocker
  • cpe:2.3:a:docker:desktop:*:*:*:*:*:windows:*:* Versions before 4.41.0 Vulnerable ·Docker

Remediation

  • Fix · CNA Docker Desktop (Docker) Fixed in 4.41.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3224
  2. 2026-10-03 Alias added: GHSA-6233-jj46-vp44

References

Other 1

  • TI-2024-08066 Cross-site scripting in Docker Desktop CVSS 4.0HIGH 8.9
  • TI-2024-08065 Cross-site scripting in Docker Desktop CVSS 4.0CRITICAL 9.0
  • TI-2022-17400 Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file… CVSS 3.1HIGH 7.8
  • TI-2021-15651 Docker Desktop before 3.6.0 suffers from incorrect access control. CVSS 3.1HIGH 7.8
  • TI-2024-05770 In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop… CVSS 4.0HIGH 7.3
  • TI-2023-01694 Cleartext transmission of sensitive information in Docker Desktop CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences