Local Privilege Escalation in Docker Desktop (CVE-2025-15558) Threatens Enterprise Development Environments

Local Privilege Escalation in Docker Desktop (CVE‑2025‑15558) Threatens Enterprise Development Environments

What It Is — Docker Desktop contains an uncontrolled search‑path element in its plugins directory. An attacker who can run low‑privileged code can force the Docker client to load a malicious binary from an untrusted location, resulting in local privilege escalation (LPE).

Exploitability — CVSS 7.8 (High). The flaw is locally exploitable; no public exploit code is circulating, but a proof‑of‑concept was disclosed with the advisory. Attackers first need a foothold on a developer workstation or a compromised CI/CD runner.

Affected Products — Docker Desktop for Windows and macOS (all versions prior to the 2026‑03‑06 security update).

TPRM Impact

• Compromised developer machines can be used to pivot into corporate networks, exposing source code, build artefacts, and downstream SaaS services.
• CI/CD pipelines that automatically pull Docker plugins may inherit the elevated privileges, creating a supply‑chain attack vector.

Recommended Actions

1. Upgrade Docker Desktop to version 4.22.0 or later (security update released 2026‑03‑06).
2. Enforce least‑privilege execution policies on developer endpoints; block execution from the Docker plugins folder unless explicitly approved.
3. Deploy endpoint detection that alerts on unexpected process launches from ~/.docker/plugins or the Windows equivalent.
4. Incorporate CVE‑2025‑15558 into your vulnerability‑management and third‑party risk registers, and verify that any managed service providers using Docker Desktop have applied the patch.

Source: Zero Day Initiative Advisory ZDI‑26‑152