# CVE-2026-112917: Docker Desktop for Windows WSL2 seccomp bypass via 32-bit socketcall

Source: https://junglewise.ai/threats/cve-2026-112917-in-docker-desktop-for-windows-with-the-wsl2-backend-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-112917 · Severity: info · Published 2026-11-03

Docker Desktop for Windows with WSL2 backend allows unprivileged containers to bypass security restrictions using 32-bit system calls, potentially exposing host files and services. An attacker running a container could access sensitive data or interact with Windows services that should be isolated. This primarily affects systems using the x86-64 WSL2 backend. The vulnerability requires a container runtime environment and is automatically resolved by keeping Docker Desktop and WSL packages up to date.

Technologies: [Microsoft Windows Subsystem For Linux](https://junglewise.ai/threats/technologies/windows-subsystem-for-linux). Vendors: [Docker](https://junglewise.ai/threats/vendors/docker), [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-112917 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112917 being exploited in the wild.

**How severe is CVE-2026-112917?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Docker Desktop for Windows before 4.98.0 on x86-64 WSL2; Microsoft Windows Subsystem For Linux before 3.0.3.

**Is there a fix for CVE-2026-112917?** Yes: fixed in Docker Desktop 4.98.0 and later (with WSL 3.0.3 or later). Until then: Upgrade Docker Desktop to version 4.98.0 or later and ensure WSL is updated to version 3.0.3 or later; Docker Desktop 4.98.0+ running on an older WSL kernel will not fully mitigate the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112917 attacked?** It is attacked over the network or with local access, in a network appliance.

**Am I affected by CVE-2026-112917?** Check whether you run Docker Desktop for Windows or Microsoft Windows Subsystem For Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Docker Desktop 4.98.0 and later (with WSL 3.0.3 or later)

Upgrade Docker Desktop to version 4.98.0 or later and ensure WSL is updated to version 3.0.3 or later; Docker Desktop 4.98.0+ running on an older WSL kernel will not fully mitigate the issue.

## Technical details

The vulnerability exists in Docker Desktop's seccomp sandbox on x86-64 WSL2, where the default security policy blocks AF_VSOCK socket operations but fails to restrict 32-bit socketcall syscalls that can achieve the same effect. An unprivileged container can invoke 32-bit socketcall(17, ...) to bypass seccomp and access AF_VSOCK, exposing host-facing services and user files. A complete fix requires both Docker Desktop 4.98.0+ and WSL 3.0.3+; running newer Docker on older WSL kernels remains vulnerable.

## Affected products

- Docker Docker Desktop for Windows before 4.98.0 on x86-64 WSL2
- Microsoft Windows Subsystem for Linux before 3.0.3

## Timeline

- 2026-11-03: disclosed

## References

- [https://docs.docker.com/desktop/release-notes/](https://docs.docker.com/desktop/release-notes/)
- [https://github.com/microsoft/WSL/releases/tag/3.0.3](https://github.com/microsoft/WSL/releases/tag/3.0.3)

## Related threats

- [Windows Subsystem for Linux use-after-free privilege escalation](https://junglewise.ai/threats/cve-2026-88237-use-after-free-in-windows-subsystem-for-linux-allows-an)
- [Windows Subsystem for Linux out-of-bounds read privilege escalation](https://junglewise.ai/threats/cve-2026-119846-out-of-bounds-read-in-windows-subsystem-for-linux-allows-an)
- [Microsoft Windows Subsystem for Linux heap buffer overflow](https://junglewise.ai/threats/cve-2026-119834-heap-based-buffer-overflow-in-windows-subsystem-for-linux-allows)
- [Microsoft Windows Subsystem for Linux information disclosure](https://junglewise.ai/threats/cve-2026-96206-use-of-uninitialized-resource-in-windows-subsystem-for-linux)
- [Windows Subsystem for Linux TOCTOU race condition privilege escalation](https://junglewise.ai/threats/cve-2026-85879-time-of-check-time-of-use-toctou-race-condition-in-windows)