vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-15514

N/A
Published: September 1, 2018 at 01:00 AM UTC
Updated: June 17, 2026 at 01:42 AM UTC
1 product affected across 1 vendorDocker

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 2%

Description

HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Docker· Docker
95%
1.10.0.0-01.10.1.42-11.10.2.121.10.2.141.10.4.01.10.61.11.01.11.0 beta101.11.0 beta71.11.0 beta81.11.0 beta91.11.1 beta111.11.1 beta11b1.11.1 beta121.11.1 beta131.11.1 beta141.11.2 beta151.12.01.12.0 beta211.12.0 beta221.12.0 rc2-beta161.12.0 rc2-beta171.12.0 rc3-beta181.12.0 rc3-beta18.11.12.0 rc4-beta191.12.0 rc4-beta201.12.11.12.1 beta241.12.1 beta251.12.1 beta261.12.1 beta29.11.12.1 rc1-beta231.12.2 beta29.21.12.2 rc1-beta271.12.2 rc3-beta281.12.31.12.3 beta29.31.12.3 beta301.12.3 rc1-beta291.12.51.13.01.13.0 beta381.13.0 beta391.13.0 rc2-beta311.13.0 rc3-beta321.13.0 rc3-beta32.11.13.0 rc3-beta331.13.0 rc4-beta341.13.0 rc5-beta351.13.0 rc6-beta361.13.0 rc7-beta371.13.11.13.1 rc1-beta401.13.1 rc2-beta4117.0.4 win717.0.5 win917.03.017.03.0 rc1-win117.03.1 win1217.04.0 win617.06.0 win1317.06.0 win1417.06.0 win1517.06.0 win1617.06.0 win1717.06.0 win1817.06.1 rc1-win2017.06.1 rc1-win2417.06.2 win2717.07.0 rc1-win2117.07.0 rc2-win2217.07.0 rc3-win2317.07.0 rc4-win2517.07.0 win2617.09.0 rc1-win2817.09.0 rc2-win2917.09.0 rc3-win3017.09.0 win3117.09.0 win3217.09.0 win3317.09.0 win3417.09.1 win4217.10.0 win3617.11.0 rc2-win3717.11.0 rc3-win3817.11.0 rc4-win3917.11.0 win4017.12.0 rc2-win4117.12.0 rc3-win4317.12.0 rc4-win4417.12.0 win4517.12.0 win4617.12.0 win4718.01.0 win4818.02.0 rc1-win5018.02.0 rc2-win5118.02.0 win5218.03.0 rc3-win5618.03.0 win5818.03.0 win5918.03.1 win6518.04.0 rc2-win6118.05.0 rc1-win6318.05.0 win66

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (4)

VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/105202
x_refsource_MISCVendor Advisory
Source: [email protected]
https://docs.docker.com/docker-for-windows/edge-release-notes/
x_refsource_MISCVendor Advisory
Source: [email protected]
https://docs.docker.com/docker-for-windows/release-notes/
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://srcincite.io/blog/2018/08/31/you-cant-contain-me-analyzing-and-exploiting-an-elevation-of-privilege-in-docker-for-windows.html

CVSS

6.5MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-502

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card