CVE-2025-3224 Details
Description
A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts to delete files and subdirectories under the path C:\ProgramData\Docker\config with high privileges. However, this directory often does not exist by default, and C:\ProgramData\ allows normal users to create new directories. By creating a malicious Docker\config folder structure at this location, an attacker can force the privileged update process to delete or manipulate arbitrary system files, leading to Elevation of Privilege.
A vulnerability exists in the update process of Docker Desktop for Windows, affecting versions prior to 4.41.0. This vulnerability could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During updates, Docker Desktop attempts to delete files in the C:\ProgramData\Docker\config directory with elevated privileges. However, this directory typically does not exist by default, and normal users can create new directories in C:\ProgramData\. By establishing a malicious folder structure in the right location, an attacker can manipulate the update process to delete or alter arbitrary system files, resulting in unauthorized privilege escalation.
Users are advised to update Docker Desktop for Windows to version 4.41.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| docker desktop | < 4.41.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 10, 2025 | Initial Analysis | [email protected] |
| Apr 28, 2025 | New CVE Received | [email protected] |