CVE-2025-9164: Docker Desktop DLL Hijacking Vulnerability

CVE-2025-9164 Overview

CVE-2025-9164 is a DLL hijacking vulnerability in Docker Desktop Installer.exe that stems from an insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, creating an opportunity for local privilege escalation through malicious DLL placement. This vulnerability affects Docker Desktop through version 4.48.0.

Critical Impact

Local attackers can achieve privilege escalation by placing a malicious DLL in the user's Downloads folder, which will be loaded by the Docker Desktop installer with elevated privileges.

Affected Products

• Docker Desktop through version 4.48.0
• Docker Desktop Installer.exe (Windows)

Discovery Timeline

• 2025-10-27 - CVE-2025-9164 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2025-9164

Vulnerability Analysis

This vulnerability is classified under CWE-427 (Uncontrolled Search Path Element), which occurs when a product uses a search path that includes directories which are not intended to be used as sources for the executable or library. In the case of CVE-2025-9164, the Docker Desktop installer follows an insecure DLL search order that prioritizes the user's Downloads folder over trusted system directories.

When a user downloads and executes the Docker Desktop installer from their Downloads folder, the installer attempts to load various DLLs during its execution. Due to the improper search order, any DLL placed in the same directory as the installer will be loaded before the legitimate system DLLs. Since the installer typically runs with elevated privileges during the installation process, a malicious DLL would inherit those privileges, enabling local privilege escalation.

Root Cause

The root cause of this vulnerability lies in the insecure DLL search order implemented by the Docker Desktop Installer. Windows applications that do not explicitly specify the full path to required DLLs rely on a predefined search order. When an application is launched from a user-writable directory such as Downloads, that directory is searched before system directories. The Docker Desktop installer failed to implement safe DLL loading practices, such as using SetDllDirectory("") to remove the current directory from the search path or using absolute paths for DLL loading.

Attack Vector

The attack vector requires local access to the target system. An attacker must be able to place a malicious DLL file in the user's Downloads folder (or the same directory where the installer will be executed). The attack unfolds as follows:

1. The attacker crafts a malicious DLL that exports the same functions as a DLL required by the Docker Desktop installer
2. The malicious DLL is placed in the target user's Downloads folder with the expected filename
3. When the victim downloads and executes the Docker Desktop installer, the malicious DLL is loaded instead of the legitimate system DLL
4. The attacker's code executes with the same privileges as the installer, typically elevated/administrator privileges

This attack is particularly effective when targeting systems where users commonly download and run installers from their Downloads folder without relocating them to a secure directory.

Detection Methods for CVE-2025-9164

Indicators of Compromise

• Unexpected DLL files appearing in user Downloads folders, particularly with common system DLL names
• Process execution logs showing the Docker Desktop installer loading DLLs from non-standard paths
• New or modified DLL files in the Downloads directory with timestamps correlating to Docker Desktop installation attempts
• Unusual child processes or network connections spawned by the Docker Desktop installer

Detection Strategies

• Monitor file creation events in user Downloads folders for DLL files, especially those matching common system library names
• Implement application whitelisting to prevent unauthorized DLL loading
• Use endpoint detection and response (EDR) solutions to track DLL loading behavior during installer execution
• Configure SIEM rules to alert on installer processes loading libraries from user-writable directories

Monitoring Recommendations

• Enable Windows Security Event logging for process creation (Event ID 4688) with command line auditing
• Deploy Sysmon with rules to monitor DLL loading events (Event ID 7) for installer processes
• Regularly audit Downloads folders for suspicious DLL files that don't match expected software distributions
• Implement file integrity monitoring for common attack surfaces like user profile directories

How to Mitigate CVE-2025-9164

Immediate Actions Required

• Upgrade Docker Desktop to a version newer than 4.48.0 that addresses this vulnerability
• Move downloaded installers to a protected directory (e.g., C:\Installers) before execution
• Verify the integrity of installers using official checksums before running them
• Clear the Downloads folder of any unexpected DLL files before running installers
• Consider running installers from a clean, dedicated directory with restricted permissions

Patch Information

Docker has addressed this vulnerability in versions after 4.48.0. Organizations should upgrade to the latest version of Docker Desktop as soon as possible. For detailed patch information and release notes, refer to the Docker Desktop Release Notes.

Workarounds

• Always move installer files to a secure, non-user-writable directory before execution
• Audit the Downloads folder for suspicious DLL files before running any installers
• Implement Group Policy settings to restrict DLL loading from user directories
• Use application control solutions to prevent unauthorized DLL execution
• Consider deploying Docker Desktop via enterprise software distribution tools rather than manual installer downloads

# Create a secure installation directory and move installer before execution
mkdir C:\SecureInstallers
icacls C:\SecureInstallers /inheritance:r /grant:r Administrators:F /grant:r SYSTEM:F
move "%USERPROFILE%\Downloads\Docker Desktop Installer.exe" C:\SecureInstallers\
cd C:\SecureInstallers
"Docker Desktop Installer.exe"