PT-2026-21675 · Grpcfuse+1 · Grpcfuse+1

Pumpkin · Published 2026-02-24 · Updated 2026-03-26 · CVE-2026-2664

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker Desktop versions prior to 4.62.0

Description An out of bounds read issue exists in the grpcfuse kernel module within the Linux VM used by Docker Desktop for Windows, Linux, and macOS. This could allow a local attacker to potentially cause harm by writing to /proc/docker entries. The vulnerable component is the grpcfuse kernel module.

Recommendations Update to Docker Desktop version 4.62.0 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-2664

ZDI-26-125

Affected Products

Docker Desktop

Grpcfuse

References · 12

• https://zerodayinitiative.com/advisories/ZDI-26-125 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2664 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2664 · Vendor Advisory
• https://reddit.com/r/Hosting_World/comments/1s42xks/two_new_docker_desktop_cves_you_should_know_about · Reddit Post
• https://docs.docker.com/desktop/release-notes/#4620 · Note
• https://t.me/cveNotify/152987 · Telegram Post
• https://twitter.com/SystemTek_UK/status/2027393876126740895 · Twitter Post
• https://twitter.com/cracbot/status/2028062792742564268 · Twitter Post
• https://t.me/cveNotify/153545 · Telegram Post
• https://twitter.com/cracbot/status/2027700481959793132 · Twitter Post
• https://t.me/CVEtracker/45589 · Telegram Post
• https://twitter.com/CVEnew/status/2026265013439123833 · Twitter Post