CVE-2026-106581 — Docker Desktop for Windows installer failed to verify external packages

CVE-2026-106581

Docker Desktop for Windows installer failed to verify external packages PUBLISHED

Description (CNA)

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.

Affected (CNA)

Vendor / product	Versions
Docker / Docker Desktop	affected 0 before 4.92.0

CWE

CWE-347

References

https://docs.docker.com/desktop/release-notes/#4920

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.