Description
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.
Published: 2026-10-09
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Local privilege escalation
Action: Immediate Patch
AI Analysis

Impact

Docker Desktop for Windows installers (prior to 4.92.0) accepted external packages supplied to the installer command line without verifying their digital signatures. If a malicious package is inserted and the user authorizes the standard UAC prompt, the installer runs with Windows LocalSystem privileges, allowing the attacker’s code to execute as the most privileged user on the machine.

Affected Systems

All Docker Desktop for Windows releases older than version 4.92.0 are impacted. The vulnerability applies to the Docker Desktop installer executable, which users normally run to install or upgrade a Docker Desktop instance on Windows.

Risk and Exploitability

The CVSS score of 8.2 signifies a high severity vulnerability. Exploitation requires a user to run the installer with a crafted package and to accept the UAC prompt, so the attack vector is limited to local or user‑facing scenarios. EPSS is not available, and the vulnerability is not listed in CISA KEV, indicating no known active exploitation yet. Nevertheless, because the flaw allows execution as LocalSystem, the potential impact is severe and should be addressed promptly.

Generated by OpenCVE AI on October 9, 2026 at 16:10 UTC.

Remediation

Vendor Workaround

Do not run Docker Desktop Installer.exe with untrusted -package files.

OpenCVE Recommended Actions

  • Upgrade Docker Desktop to version 4.92.0 or newer, which includes signature verification for external packages.
  • Do not run Docker Desktop Installer.exe with untrusted -package files as a temporary protection.
  • Verify the digital signature of any external package before providing it to the installer, and ensure user consent to the UAC prompt is strictly for trusted sources.
  • If immediate upgrade is infeasible, consider disabling the ability to provide external packages through the installer or removing the -package option.

Generated by OpenCVE AI on October 9, 2026 at 16:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.
Title Docker Desktop for Windows installer failed to verify external packages
First Time appeared Docker
Docker desktop
Weaknesses CWE-347
CPEs cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*
Vendors & Products Docker
Docker desktop
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Docker Desktop
cve-icon MITRE

Status: PUBLISHED

Assigner: Docker

Published:

Updated: 2026-10-09T16:46:27.791Z

Reserved: 2026-10-06T20:34:21.899Z

Link: CVE-2026-106581

cve-icon Vulnrichment

Updated: 2026-10-09T16:16:17.265Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-09T14:17:18.433

Modified: 2026-10-09T17:16:45.270

Link: CVE-2026-106581

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T16:15:08Z

Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature