8.9
High
CVE-2024-8696 A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a…
Description
A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Docker Desktop 4.34 | earliest → < 4.34.2 | 4.34.2 |
| docker_desktop 4.34 | earliest → < 4.34.2 | 4.34.2 |
Other CVEs of Docker Desktop
The 22 CVEs of Docker Desktop →
CVE-2026-112917
Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
9.2
Critical
CVE-2026-114409
Docker Desktop logs can expose stored third-party credentials
5.7
Medium
CVE-2026-106581
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop…
8.2
High
CVE-2026-17106
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer…
7.1
High