What’s Vulnerable › Vulnerabilities

CVE-2020-11492

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-05 · updated 2026-06-17
• Weakness: CWE-362

Description

An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges.

Affected products

• Docker Inc. Docker Desktop: through 2.2.0.5

References

• https://docs.docker.com/docker-for-windows/release-notes/
• https://www.pentestpartners.com/security-blog/docker-desktop-for-windows-privesc-cve-2020-11492/
• https://docs.docker.com/docker-for-windows/release-notes/
• https://www.pentestpartners.com/security-blog/docker-desktop-for-windows-privesc-cve-2020-11492/

Get alerted when CVE-2020-11492 or the next vulnerability affects your stack