CVE-2025-9164CWE-427

CVE-2025-9164

published October 27, 2025

CVSS
8.8
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement.This issue affects Docker Desktop: through 4.48.0.

The record
Technical detail
CVSS
8.8 · NONE
CVSS v4.0
Not supplied
EPSS
0.00111 · 1.3th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-10-27T18:15Z
References (1)
https://docs.docker.com/desktop/release-notes/ · [email protected]
EPSS history
Timeline
  • 27 OCT 13:53Z
    Multiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for Windows
    cvelistv5