High severity · published Oct 27, 2025
CVE-2025-9164
Multiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for Windows
8.8
CVSS
0.1%
EPSS
No
On KEV
Description
Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement.This issue affects Docker Desktop: through 4.48.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Docker Desktop · Docker
through 4.48.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9164
docs.docker.com
https://docs.docker.com/desktop/release-notes/
More from Docker Desktop
9.8
CVE-2024-8696
A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.
9.8
CVE-2024-8695
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.
9.8
CVE-2023-0626
Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route
9.8
CVE-2023-0625
Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog
9.3
CVE-2025-9074
Docker Desktop allows unauthenticated access to Docker Engine API from containers