ZDI-26-068: Docker Desktop for Windows Incorrect Permission Assignment Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop for Windows. User interaction on the part of an administrator is required to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop for Windows. User interaction on the part of an administrator is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.7. The following CVEs are assigned: CVE-2025-14740.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-068?
The severity of ZDI-26-068 is classified as a privilege escalation vulnerability that poses a significant risk to affected installations.
How do I fix ZDI-26-068?
To fix ZDI-26-068, ensure that you update Docker Desktop for Windows to the latest version provided by the vendor.
Who is affected by ZDI-26-068?
ZDI-26-068 affects users of Docker Desktop for Windows, specifically those with local administrative privileges.
What are the consequences of ZDI-26-068 if exploited?
If exploited, ZDI-26-068 allows local attackers to escalate their privileges, potentially compromising the system.
Is user interaction required to exploit ZDI-26-068?
Yes, user interaction on the part of an administrator is required to exploit the ZDI-26-068 vulnerability.