Docker CLI CVE-2025-15558

Exploitation requires: (1) local access as a low-privileged user on a Windows host (PR:L) able to create the non-default directory C:\ProgramData\Docker\cli-plugins and write executables named after Docker plugins (e.g., docker-compose.exe, docker-buildx.exe); (2) a Windows Docker binary that uses the cli-plugins/manager package (Docker Compose, Buildx, or Docker Desktop) at version ≤ 29.1.5; and (3) user interaction (UI:P) - a higher-privileged victim must subsequently open Docker Desktop or invoke a CLI plugin feature, which triggers execution. Limiting factors: it is Windows-only, requires an existing local foothold, the directory must not already be locked down by an administrator, and meaningful privilege escalation only occurs if the victim runs Docker as a privileged user; if the only Docker user is the attacker themselves, there is no privilege gain.

Signals are internally consistent and point to a real but bounded local risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P, VC:H/VI:H/VA:H) describes a local, low-privilege, passive-user-interaction attack with high impact - i.e., classic privilege escalation, not remote compromise. EPSS is 0.01% (1st percentile), which is expected for a local PE that requires a privileged victim to invoke Docker and is therefore not mass-exploitable; this low score is not a contradiction of severity. The vulnerability is not in CISA KEV and no public exploit code was identified, so this is not an active-exploitation emergency. The realistic priority is moderate: it matters most on multi-user Windows workstations or where Docker is run by administrators/CI service accounts, and less on single-user developer machines. SSVC framing: exploitation = none observed, automatable = no (needs a privileged user to trigger), technical impact = total. Treat as a patch-on-cycle hardening item rather than emergency remediation.

On a shared Windows machine, a standard user creates C:\ProgramData\Docker\cli-plugins and drops a malicious docker-compose.exe. When an administrator later opens Docker Desktop or runs a Docker CLI plugin command, the planted binary executes in the administrator's context, granting code execution and privilege escalation. No public exploit code was identified, though ZDI documented the issue under ZDI-CAN-28304.