CVE-2026-77179: Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Docker Sandboxes users on macOS are exposed when an untrusted or malicious guest can interact with the virtio-fs shared workspace. The impact is limited to files accessible to the VMM user, but may include host code execution.
What does an attacker need to exploit it?
An attacker needs the ability to run malicious activity inside a Docker Sandbox guest and manipulate the shared workspace. The exploit relies on replacing a parent directory with a symlink while the virtio-fs server reopens an unlinked file using its stored path.
How can I mitigate the issue if I cannot patch immediately?
Do not run untrusted guests or workloads in Docker Sandboxes on macOS, and avoid exposing sensitive host files through the shared workspace. Restrict the VMM user's access to host files where possible.