{"id":"CVE-2026-106581","published":"2026-10-09T14:17:18.433","lastModified":"2026-10-09T17:16:45.270","description":"Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://docs.docker.com/desktop/release-notes/#4920","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}