A 32‑bit socketcall is used by an unprivileged Linux container running on Docker Desktop for Windows with WSL2 to sidestep the default seccomp restrictions on AF_VSOCK. This flaw can allow the container to reach host‑side services and access Windows files that belong to the logged‑in user. The weakness is classified as CWE‑424, indicating a failure in enforcing confinement boundaries.

The vulnerability affects Docker Desktop for Windows when configured to use the WSL2 backend on x86‑64 systems. All Docker Desktop releases prior to 4.98.0 are affected; Docker Desktop 4.98.0 or later remains vulnerable unless the host runs WSL kernel 3.0.3 or newer. The issue does not impact LinuxKit‑based backends or non‑x86‑64 architectures.

The high CVSS score of 9.2 reflects the significant impact of bypassing isolation. Although EPSS values are not available, the flaw is not listed in the CISA KEV catalog. Attackers can exploit the vector by creating an unprivileged container on a compromised host, then using the 32‑bit socketcall to access host resources that should be isolated. Successful exploitation would give the attacker access to sensitive host files and Windows services exposed to the logged‑in user, potentially enabling further attacks. The requirement for a Docker Desktop + WSL2 configuration limits the affected scope to environments where this stack is in use.