Description
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Docker | Docker Desktop | < 4.92.0 | 4.92.0 |
Advisories 1
- WID-SEC-2026-3851 Docker Desktop: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 11, 2026
References
- https://docs.docker.com/desktop/release-notes/#4920 release-notes