Elevation of Privilege Vulnerability in Docker Desktop for Windows by Docker Inc.

CVE-2025-3224

What is CVE-2025-3224?

A security issue in Docker Desktop for Windows versions before 4.41.0 allows local attackers with low privileges to escalate their user permissions to SYSTEM. The flaw occurs during the update process, wherein Docker Desktop attempts to remove files and directories from C:\ProgramData\Docker\config using elevated privileges. Since this directory may not be present by default, a normal user can create a malicious folder structure at this path. This manipulation enables the low-privileged attacker to cause the update mechanism to delete or alter arbitrary system files, resulting in potential escalation of privileges.

References