CVE detail
CVE-2025-15558
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/[email protected]+incompatible/cli-plugins/manager package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 19.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15558.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comMar 4, 2026, 5:16 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2444574bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMar 4, 2026, 5:16 PM - https://access.redhat.com/security/cve/CVE-2025-15558access.redhat.com
No excerpt available.
Exploitaccess.redhat.comMar 4, 2026, 5:16 PM - https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/www.zerodayinitiative.com
No excerpt available.
Exploitwww.zerodayinitiative.comMar 4, 2026, 5:16 PM - https://github.com/docker/cli/pull/6713github.com
No excerpt available.
Exploitgithub.comMar 4, 2026, 5:16 PM - https://docs.docker.com/desktop/release-notes/docs.docker.com
No excerpt available.
Mitigationdocs.docker.comMar 4, 2026, 5:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-48272CVSS 7.8 · High
Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploit d…
- CVE-2026-57239CVSS 8.2 · High
The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to N…
- CVE-2026-47937CVSS 7.7 · High
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in t…
- CVE-2026-3775CVSS 7.8 · High
The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is no…
- CVE-2026-22561CVSS 4.7 · Medium
Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hij…
- CVE-2026-2713CVSS 7.4 · High
IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontrolled search path eleme…