Is CVE-2026-112917 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112917 being exploited in the wild.

How severe is CVE-2026-112917?

Informational severity, published 3 November 2026.

Which products and versions are affected?

Docker Desktop for Windows before 4.98.0 on x86-64 WSL2; Microsoft Windows Subsystem For Linux before 3.0.3.

How is CVE-2026-112917 attacked?

It is attacked over the network or with local access, in a network appliance.

Am I affected by CVE-2026-112917?

Check whether you run Docker Desktop for Windows or Microsoft Windows Subsystem For Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112917: Docker Desktop for Windows WSL2 seccomp bypass via 32-bit socketcall

CVE-2026-112917 · Severity: info · Published 2026-11-03

Docker Desktop for Windows with WSL2 backend allows unprivileged containers to bypass security restrictions using 32-bit system calls, potentially exposing host files and services. An attacker running a container could access sensitive data or interact with Windows services that should be isolated. This primarily affects systems using the x86-64 WSL2 backend. The vulnerability requires a container runtime environment and is automatically resolved by keeping Docker Desktop and WSL packages up to date.

Technologies: Microsoft Windows Subsystem For Linux. Vendors: Docker, Microsoft.

Quick answers

Is CVE-2026-112917 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112917 being exploited in the wild.
How severe is CVE-2026-112917?: Informational severity, published 3 November 2026.
Which products and versions are affected?: Docker Desktop for Windows before 4.98.0 on x86-64 WSL2; Microsoft Windows Subsystem For Linux before 3.0.3.
Is there a fix for CVE-2026-112917?: Yes: fixed in Docker Desktop 4.98.0 and later (with WSL 3.0.3 or later). Until then: Upgrade Docker Desktop to version 4.98.0 or later and ensure WSL is updated to version 3.0.3 or later; Docker Desktop 4.98.0+ running on an older WSL kernel will not fully mitigate the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112917 attacked?: It is attacked over the network or with local access, in a network appliance.
Am I affected by CVE-2026-112917?: Check whether you run Docker Desktop for Windows or Microsoft Windows Subsystem For Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Docker Desktop 4.98.0 and later (with WSL 3.0.3 or later)

Upgrade Docker Desktop to version 4.98.0 or later and ensure WSL is updated to version 3.0.3 or later; Docker Desktop 4.98.0+ running on an older WSL kernel will not fully mitigate the issue.

Technical details

The vulnerability exists in Docker Desktop's seccomp sandbox on x86-64 WSL2, where the default security policy blocks AF_VSOCK socket operations but fails to restrict 32-bit socketcall syscalls that can achieve the same effect. An unprivileged container can invoke 32-bit socketcall(17, ...) to bypass seccomp and access AF_VSOCK, exposing host-facing services and user files. A complete fix requires both Docker Desktop 4.98.0+ and WSL 3.0.3+; running newer Docker on older WSL kernels remains vulnerable.

Affected products

Docker Docker Desktop for Windows before 4.98.0 on x86-64 WSL2
Microsoft Windows Subsystem for Linux before 3.0.3

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.