This vulnerability allows an attacker who can upload a compressed archive to a Docker container to cause the Docker daemon to execute a decompression binary located inside the container rather than the host’s benign binary. The daemon incorrectly orders operations, resolving the binary path from the container filesystem. If the container image contains a trojan‑ized decompression binary such as a malicious xz or unpigz, the daemon will run that binary with the same privileges it holds, resulting in full daemon privileges—root UID and unrestricted capabilities on the host.

Affected vendors and products include Docker Engine (docker/daemon) and Moby (moby/v2/daemon). Versions prior to Docker Engine 29.5.1 and Moby v2.0.0‑beta.14 are vulnerable. The issue applies to any container created from these image versions that receives a compressed archive via the REST API endpoint or through docker cp piped input.

The CVSS base score is 7.2, indicating a high severity. EPSS is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is inferred to be remote or local depending on whether the attacker can invoke the Docker REST API or use dockercp; the fix requires the attacker to supply a payload archive. Thus, exploitation is possible on systems where the daemon trusts untrusted containers or when images are not verified, and it could lead to widespread host compromise if the vulnerability is triggered.