>

CVE-2025-9074

malware scan code search

A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the "Expose daemon on tcp://localhost:2375 without TLS" option enabled. This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop.

-
cvss
common vulnerability scoring system v3.1. measures intrinsic severity on a 0-10 scale.
epss 0.0090
exploitation prediction scoring system. probability this vulnerability will be exploited in the wild in the next 30 days.
kev no
cisa known exploited vulnerabilities catalog. confirmed active exploitation.
CVSS 4.0 Common Vulnerability Scoring System v4.0
9.3 / 10
CRITICAL
exploitability
Attack Vector
Local
Attack Vector (AV:L): requires local access. attacker must have shell access or physical login.
Attack Complexity
Low
Attack Complexity (AC:L): no special conditions needed. attack can be reliably reproduced.
Attack Requirements
None
Attack Requirements (AT:N): no special deployment or execution conditions needed.
Privileges Required
None
Privileges Required (PR:N): no authentication needed. any anonymous attacker can exploit this.
User Interaction
Passive
User Interaction (UI:P): victim must perform a limited, passive action (e.g. opening a document).
vulnerable system impact
Vuln Confidentiality
High
Confidentiality (VC:H): total information disclosure. attacker gains access to all data within the component.
Vuln Integrity
High
Integrity (VI:H): complete data modification possible. attacker can modify any data.
Vuln Availability
High
Availability (VA:H): total denial of service. attacker can fully shut down the resource.
subsequent system impact
Sub Confidentiality
High
Subsequent Confidentiality: impact on data confidentiality of downstream/connected systems. Value: H (High)
Sub Integrity
High
Subsequent Integrity: impact on data integrity of downstream/connected systems. Value: H (High)
Sub Availability
High
Subsequent Availability: impact on service availability of downstream/connected systems. Value: H (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
exploit detect attrib advisory media timeline
exploitation detection attribution advisories media timeline
activity density
rdintel assessment
flagged malicious repos detected. do not execute.
public exploit available. prioritize patching.
13 threat composite score from 15+ signals including exploitation status, epss probability, detection coverage, and community attention. 0-100 scale.

sign in to view full intelligence

pocs, detection rules, timeline, advisories, and more

sign in create account