CVE-2025-15558

CVE-2025-15558 is a privilege escalation vulnerability affecting Docker CLI for Windows versions through 29.1.5 and other Windows binaries using the github.com/docker/cli/cli-plugins/manager package. A low-privileged attacker can create a specific directory (C:\ProgramData\Docker\cli-plugins) and place malicious plugin binaries there. These binaries are then executed when a victim user opens Docker Desktop or uses Docker CLI plugin features, potentially leading to privilege escalation if the Docker CLI is run with elevated privileges. The vulnerability has a CVSSv4 score of 7.0 (High), indicating a local attack vector with low complexity, requiring user interaction, and resulting in high impact to confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.