ZDI-26-758: Docker Buildx Filesystem Entitlements Protection Mechanism Failure Remote Code Execution Vulnerability
ZDI discloses a Docker Buildx entitlements flaw enabling remote code execution after user interaction.
ZDI advisory ZDI-26-758 describes a filesystem entitlements protection failure in Docker Buildx that can allow remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI rates the flaw CVSS 7.8 and assigns CVE-2026-93325. In-the-wild exploitation is not reported.
- Filesystem entitlements check failure in Docker Buildx
- Remote code execution requires user interaction
- Victim must open a malicious page or file
- ZDI CVSS 7.8; tracked as CVE-2026-93325
- CVEs
- CVE-2026-93325
- Vendors
- Docker
- Products
- Docker Buildx
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93325 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Docker Buildx. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.