CVE-2025-3224: Privilege Escalation in Docker Desktop

This vulnerability allows a local, low-privileged attacker to escalate their privileges to SYSTEM. The attack leverages the Docker Desktop update process, which attempts to delete files and subdirectories under the C:\ProgramData\Docker\config path. If this directory doesn't exist (which is common), a user can create a malicious directory structure at C:\ProgramData\Docker\config. The privileged update process then inadvertently deletes or manipulates arbitrary system files, granting the attacker complete control over the host. This is a critical vulnerability as SYSTEM access allows for complete compromise of the machine, including data exfiltration, installation of malware, and persistence.

1. Reserved2025-04-03
2. Published2025-04-28
3. EPSS updated2026-03-23

The primary mitigation is to upgrade Docker Desktop to version 4.41.0 or later. Prior to upgrading, consider creating a system backup. If the upgrade process fails, attempt a clean reinstallation of Docker Desktop. While a direct workaround is unavailable, restricting user permissions on the C:\ProgramData\ directory could reduce the attack surface. Monitor system logs for suspicious file deletion activity within the Docker configuration directory. Consider implementing application control policies to restrict Docker Desktop's access to sensitive system resources. After upgrade, verify the Docker Desktop version to ensure successful remediation.