LiveThreat Vulnerability Brief — CVE-2026-2664
What It Is — Docker Desktop’s grpcfuse kernel module contains an out‑of‑bounds read flaw that can leak kernel memory to a low‑privileged attacker. The bug stems from insufficient validation of procfs arguments, allowing a read past an allocated buffer. Exploitability — No public PoC, but the vulnerability is locally exploitable once an attacker can run unprivileged code; CVSS v3.1 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Affected Products — Docker Desktop (all supported Windows/macOS releases prior to the 4.6.2 update).
TPRM Impact — Docker Desktop is widely bundled with development workstations and CI pipelines; a compromised workstation can become a foothold for lateral movement into downstream supply‑chain services, exposing proprietary code and credentials.
Recommended Actions — 1️⃣ Deploy Docker Desktop 4.6.2 or later immediately. 2️⃣ Verify installed version via docker version and enforce update policies through endpoint management tools. 3️⃣ Restrict execution of untrusted binaries on developer machines (application whitelisting, least‑privilege policies). 4️⃣ Monitor system logs for abnormal access to /proc entries related to grpcfuse. 5️⃣ Conduct a rapid internal audit of any CI/CD runners that use Docker Desktop. Source: Zero Day Initiative Advisory ZDI‑26‑125