CVE-2025-9164
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement. This issue affects Docker Desktop through 4.48.0.
Risk Assessment
A local attacker could place a malicious DLL in the Downloads folder, which during installation could lead to code execution with elevated privileges, compromising system integrity.
Recommendation
Update Docker Desktop to a version newer than 4.48.0 and avoid running the installer from folders writable by other users.
Other vulnerabilities in Docker Desktop
See all- CVE-2026-8936High
Docker Desktop 4.76.0 fixes a VM panic caused by unbounded recursion in the grpcfuse kernel module when deeply nested directories are created on a bind-mounted host folder and a dentry invalidation event is triggered.
- CVE-2026-6406High
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containers are denied unless explicitly allowed. The --use-api-socket flag adds the mount via HostConfig.Mounts instead of HostConfig.Binds, and ECI enforcement only inspects Binds, allowing the mount to pass unchecked. This grants a container full access to the Docker Engine socket and, if the host user is logged into container registries, their authentication credentials.
Original NVD description (English source)
Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement.This issue affects Docker Desktop: through 4.48.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS