Docker patches critical Sandboxes vulnerabilities

Docker has addressed critical security vulnerabilities in Docker Sandboxes that could allow malicious code within a virtual machine to bypass isolation boundaries.

One flaw, CVE-2026-79994, involves a high-severity Unix socket exploit. The vulnerability stems from a time-of-check to time-of-use race condition where a guest could replace an intermediate directory with a symbolic link. This allows a malicious guest to redirect a host-side relay toward Unix sockets outside its authorized workspace. This affects versions 0.37.0 through those prior to 0.41.0, which has since been patched.

A separate critical flaw, CVE-2026-77179, specifically impacts macOS users. In this scenario, malicious code running inside a sandbox could escape the shared project directory to read or modify files on the host machine. The escape occurs via the virtio-fs host server by following symlinks when reopening a removed file. This vulnerability affects versions 0.28.0 up to 0.42.0 and was resolved in version 0.42.0.

As of the latest reports, there has been no confirmed active exploitation of these vulnerabilities in the wild.