8.2
High
CVE-2026-106581 Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop…
Description
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Docker Desktop 4.92 | earliest → < 4.92.0 | 4.92.0 |
References
- docs.docker.com docs.docker.com
Timeline
- Published
- Last modified
Other CVEs of Docker Desktop
The 22 CVEs of Docker Desktop →
CVE-2026-112917
Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
9.2
Critical
CVE-2026-114409
Docker Desktop logs can expose stored third-party credentials
5.7
Medium
CVE-2026-17106
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer…
7.1
High
CVE-2026-8936
Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested…
8.2
High