CVE-2025-3224

Summary

CVE-2025-3224 is a vulnerability affecting Docker Desktop for Windows versions below 4.41.0. During the update process, Docker Desktop, which runs with high privileges, attempts to delete files and subdirectories under the C:\\ProgramData\\Docker\\config path. However, this directory is not present by default in C:\\ProgramData\\, allowing normal users to create new directories. An attacker can exploit this by creating a malicious Docker\\config folder structure, leading to privileged deletion or manipulation of arbitrary system files, resulting in an Elevation of Privilege vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.