CVE-2026-2664: medium-severity vulnerability in Docker Desktop
Out of bounds read vulnerability in grpcfuse kernel module
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.2%
An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up to version 4.61.0 could allow a local attacker to cause an unspecified impact by writing to /proc/docker entries. The issue has been fixed in Docker Desktop 4.62.0 .
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Docker · Docker DesktopRelated CVEs — Docker Desktop
In the same product, most dangerous first.
CVE-2025-9074CRITICALDocker Desktop allows unauthenticated access to Docker Engine API from containersEPSS 1.9%CVE-2024-8695CRITICALA remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.EPSS 1.3%CVE-2024-8696HIGHA remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.EPSS 1.2%CVE-2023-1802MEDIUMIn Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failedEPSS 0.5%CVE-2024-9348HIGHDocker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build viewEPSS 0.5%CVE-2026-17106HIGHTar extraction in moby/go-archive can write outside the destination directory via link followingEPSS 0.4%