Docker Inc. Docker Desktop
11 CVEs affecting Docker Inc. Docker Desktop. Latest disclosed: 2026-02-04. Critical: 0, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5166 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0. |
CVE-2023-0626 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-0625 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-0633 | High | 7.2 | 2023-09-25 | In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop… |
CVE-2023-5165 | High | 7.1 | 2023-09-25 | Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible… |
CVE-2023-0629 | High | 7.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.soc… |
CVE-2024-6222 | High | 7.0 | 2024-07-09 | In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by pas… |
CVE-2025-14740 | Medium | 6.7 | 2026-02-04 | Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop di… |
CVE-2023-0627 | Medium | 6.7 | 2023-09-25 | Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affect… |
CVE-2024-5652 | Medium | 6.1 | 2024-07-09 | In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon co… |
CVE-2023-0628 | Medium | 6.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to… |