CVE-2026-2664 | THREATINT

Description

An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up to version 4.61.0 could allow a local attacker to cause an unspecified impact by writing to /proc/docker entries. The issue has been fixed in Docker Desktop 4.62.0 .

PUBLISHED Reserved 2026-02-18 | Published 2026-02-24 | Updated 2026-02-24 | Assigner Docker

MEDIUM: 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-125 Out-of-bounds Read

Product status

Default status

unaffected

Any version before 4.62.0

affected

Credits

Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Zero Day Initiative finder

References

docs.docker.com/desktop/release-notes/

cve.org (CVE-2026-2664)

nvd.nist.gov (CVE-2026-2664)

Download JSON