CVE-2026-77179

A symlink-resolution flaw (CWE-59) in the virtio-fs host server used by Docker Sandboxes on macOS allows a malicious guest VM to break out of its shared workspace. The bug occurs when the host server reopens an unlinked file from a stored path: the guest can replace a parent directory with a symlink so the reopen resolves outside the intended share. A successful exploit lets the guest read or modify arbitrary files on the macOS host as the VMM user, with potential host code execution, reflected in a CVSS 4.0 score of 9.4 (critical). This affects users running Docker's Sandboxes feature on macOS hosts, particularly where the sandbox is used to execute untrusted or AI-generated code. No public proof of concept is known and the flaw is not listed in CISA's KEV, so exploitation status is none known.

What to do: Update Docker Desktop on macOS to the latest release, which contains Docker's fix for the virtio-fs symlink handling, as soon as it is available to you. Until patched, disable the Sandboxes feature on macOS hosts and avoid executing untrusted or AI-generated code inside it. If the feature has been used with untrusted code, review the host for unexpected file modifications or processes running as the VMM user.