EUVD-2026-34033
GHSA-m3jp-gxgq-rpr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain container-run access on Docker Desktop host
-
DeliveryLaunch container with host bind mount on grpcfuse share
-
ExploitCreate deeply nested directory tree on shared path
-
ExecutionTrigger dentry invalidation (rename/unlink)
-
Persistgrpcfuse recurses without bound, kernel stack overflows
-
ImpactLinux VM panics, all containers terminated
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Attacker must have the ability to run a container on the target Docker Desktop host (PR:L - a local low-privileged Docker user or container tenant) and that container must have a host bind mount onto a grpcfuse-shared folder. The attacker then needs to create a sufficiently deep directory tree on the shared mount and trigger a dentry invalidation event. Exploitation is limited to Docker Desktop versions 4.33.0 through 4.75.x using the grpcfuse file-sharing backend; deployments using VirtioFS or other non-grpcfuse sharing drivers, and Docker Engine on Linux (not Docker Desktop), are not in scope. No user interaction by another party is required (UI:N), but no remote network reachability path is available (AV:L). |
| Impact | The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N/VA:H/SA:H, score 8.2) accurately reflects a high-availability, local-only DoS - there is no confidentiality or integrity impact, but a single container can take down the entire Docker VM, killing every other container and any developer workflow depending on it. EPSS data was not provided, and the CVE is not in CISA KEV, so this is no public exploit identified at time of analysis and exploitation is theoretical rather than observed. The 'Information Disclosure' tag from the input appears inconsistent with the CVSS vector (VC:N/SC:N) and the description, which describes a VM panic only - treat the tag as likely mislabeling and rely on the vector. Practical risk is moderate for shared/CI environments where one tenant can disrupt others, and low for single-developer workstations where the user already controls the VM lifecycle. |
| Exploit ScenarioDerived | A developer or CI job runs an untrusted container image on a shared Docker Desktop host with a bind mount such as -v ~/work:/work. The container repeatedly creates a deeply nested directory tree under /work and then triggers a dentry invalidation (for example by renaming or deleting an inner node), causing grpcfuse to recurse without bound and panic the Linux VM, terminating every running container on that host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 03, 2026
Denial of service in Docker Desktop versions 4.33.0 through 4.75.x allows a local low-privileged user inside a container to crash the underlying Linux VM by triggering unbounded recursion in the grpcfuse kernel module. The flaw is exercised by creating deeply nested directories on a bind-mounted host folder and forcing a dentry invalidation event, which panics the virtualization layer that backs the entire Docker engine. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Upgrade Docker Desktop to vendor-released patch version 4.76.0 or later, as documented in the Docker Desktop release notes at https://docs.docker.com/desktop/release-notes/#4760. If immediate upgrade is not feasible, avoid using host bind mounts from untrusted containers or switch the file-sharing implementation away from grpcfuse where the option is available (for example, VirtioFS on macOS or the WSL2 backend on Windows), which removes the vulnerable code path but may change file-sharing performance characteristics and permission semantics. As an additional compensating control, restrict who can create or run containers on shared Docker Desktop hosts (CI runners, lab machines) so that an untrusted user cannot trigger the panic, accepting the trade-off of reduced self-service for developers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Docker Desktop uses grpcfuse, a custom FUSE-based filesystem driver, to share host directories into the Linux virtual machine that runs the Docker engine on macOS and Windows. The vulnerability is rooted in CWE-674 (Uncontrolled Recursion): when the grpcfuse kernel module processes a dentry (directory entry) invalidation for a path with sufficient nesting depth, the invalidation walks the dentry tree recursively without any bound, blowing the kernel stack and panicking the VM. Because bind-mounts let an unprivileged container author control directory structure on the host-shared volume, the recursion source is reachable from inside any container that has a host bind mount.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/R:U
Primary rating from Vendor (Docker) · only source for this CVE.
CVSS VectorVendor: Docker
Lifecycle Timeline
3DescriptionCVE.org
Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0.
Zero Day Initiative Advisories
Executive ViewAI
Docker Desktop versions 4.33.0 through 4.75.x contain a high-severity denial-of-service vulnerability (CVSS 8.2) that allows any low-privileged user inside a container to crash the underlying Linux VM and disable the entire Docker engine. This impacts development teams, CI/CD pipelines, and any infrastructure relying on Docker Desktop, causing operational disruption until systems are restarted.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB