{
  "cveId": "CVE-2025-3224",
  "url": "https://patchblox.com/security/cve/CVE-2025-3224",
  "summary": "CVE-2025-3224 is fixed in Docker Desktop on 1 platform by Docker Desktop 4.41.0 (version 4.41.0), released April 28, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion",
  "description": "A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0\u00A0could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts to delete files and subdirectories under the path C:\\ProgramData\\Docker\\config with high privileges. However, this directory often does not exist by default, and C:\\ProgramData\\ allows normal users to create new directories. By creating a malicious Docker\\config folder structure at this location, an attacker can force the privileged update process to delete or manipulate arbitrary system files, leading to Elevation of Privilege.",
  "published": "2025-04-28T20:15:21Z",
  "severity": "",
  "cvss": 7.3,
  "cwe": "CWE-269: Improper Privilege Management",
  "epss": 0.00249,
  "epssPercentile": 0.16259,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2025-3224",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Docker Desktop",
      "fixedVersion": "4.41.0",
      "fix": "Docker Desktop 4.41.0",
      "url": "https://patchblox.com/security/fix/windows-app/docker.dockerdesktop-4.41.0",
      "released": "2025-04-28T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}