Docker Desktop CVE-2026-8936

Attacker must have the ability to run a container on the target Docker Desktop host (PR:L - a local low-privileged Docker user or container tenant) and that container must have a host bind mount onto a grpcfuse-shared folder. The attacker then needs to create a sufficiently deep directory tree on the shared mount and trigger a dentry invalidation event. Exploitation is limited to Docker Desktop versions 4.33.0 through 4.75.x using the grpcfuse file-sharing backend; deployments using VirtioFS or other non-grpcfuse sharing drivers, and Docker Engine on Linux (not Docker Desktop), are not in scope. No user interaction by another party is required (UI:N), but no remote network reachability path is available (AV:L).

The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N/VA:H/SA:H, score 8.2) accurately reflects a high-availability, local-only DoS - there is no confidentiality or integrity impact, but a single container can take down the entire Docker VM, killing every other container and any developer workflow depending on it. EPSS data was not provided, and the CVE is not in CISA KEV, so this is no public exploit identified at time of analysis and exploitation is theoretical rather than observed. The 'Information Disclosure' tag from the input appears inconsistent with the CVSS vector (VC:N/SC:N) and the description, which describes a VM panic only - treat the tag as likely mislabeling and rely on the vector. Practical risk is moderate for shared/CI environments where one tenant can disrupt others, and low for single-developer workstations where the user already controls the VM lifecycle.

A developer or CI job runs an untrusted container image on a shared Docker Desktop host with a bind mount such as -v ~/work:/work. The container repeatedly creates a deeply nested directory tree under /work and then triggers a dentry invalidation (for example by renaming or deleting an inner node), causing grpcfuse to recurse without bound and panic the Linux VM, terminating every running container on that host.