The guest‑to‑host Unix-domain socket relay in Docker Sandboxes first verifies that a target socket path resides inside an authorized workspace, but later reconnects using the literal pathname. A malicious container can perform a time‑of‑check to time‑of‑use race by replacing an intermediate directory with a symbolic link between the validation and the connection steps, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host‑side capabilities that the targeted socket provides.

Docker Sandboxes components that expose the guest‑to‑host Unix‑domain socket relay are affected; the CVE description does not specify which releases contain the flaw, so any version that implements the described logic is potentially vulnerable.

The CVSS score of 8.7 reflects high severity, but the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious or compromised guest capable of orchestrating a symlink race, so the attack vector is local to the host environment’s container infrastructure. If successful, the host’s arbitrary socket can be accessed, potentially leaking sensitive data or enabling further attacks against host processes.