Docker Desktop CVE-2026-106581

Exploitation requires the affected product Docker Desktop for Windows at a version before 4.92.0, and specifically the use of the command-line installer feature 'Docker Desktop Installer.exe install -package' with an attacker-supplied package. The attacker must (1) already be able to place or deliver a crafted package on the target host (local access per AV:L), and (2) convince a user to actively approve the Docker-signed UAC elevation prompt (UI:A). The signature of the supplied package is not verified, which is the root flaw. Limiting factors that reduce realistic risk: the attack is local rather than remote, it needs an existing low-privileged foothold (PR:L), it cannot succeed without the victim approving an elevation prompt, and it is confined to Windows installations older than 4.92.0 - patched versions verify the package signature.

CVSS 4.0 base score is 7.3 (HIGH), but the vector tells a more constrained story than the headline number: AV:L (local), AT:P (an attack requirement must be met), PR:L (attacker already has low-level access), and UI:A (active user interaction required). Exploitation therefore depends on a chain of preconditions - local delivery of a crafted package plus a victim actively approving a Docker-signed UAC elevation prompt - rather than remote, unauthenticated reach. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis.' The core defect (CWE-347, improper signature verification on packages passed to Docker Desktop Installer.exe install -package) is genuinely serious because successful exploitation yields LocalSystem execution with full scope change (SC:H/SI:H/SA:H), but the social-engineering and local-access gating makes this a credible targeted-attack / malicious-insider risk rather than a mass-exploitation priority. Signals are internally consistent - high impact, low likelihood of opportunistic exploitation - so this warrants prompt patching on developer workstations but is not an emergency akin to a remote unauthenticated RCE. Note that no CVSS 3.1 vector or EPSS data was provided for cross-validation; only the 4.0 vector is available.

An attacker who already has local, low-privileged access to a Windows developer workstation (or who socially engineers a user into running a prepared command) places a maliciously crafted installer package on the system and invokes 'Docker Desktop Installer.exe install -package' against it. Because versions before 4.92.0 do not verify the package signature, the attacker's installer actions run as LocalSystem the moment the user approves the legitimately Docker-signed UAC prompt, which appears trustworthy. No public exploit code is referenced, so this scenario is inferred from the description and CVSS vector.