CVE-2026-77179

Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

No known exploitation. EPSS puts it in the 9th percentile. Only a workaround so far.

CVSS —Not scored EPSS percentile9th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixWorkaroundNo fixed build yet

Published 2026-09-15Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Steps

Written by AI from the record

On each Mac that runs Docker Sandboxes, check whether Docker Sandboxes is installed and identify its version.
If it is earlier than 0.42.0, update Docker Sandboxes to version 0.42.0 or later.
Until updating is complete, use --clone mode and avoid additional read-write host mounts.
Review sandbox activity and host-file changes for anything unexpected after updating.

Usually a quick update

What it is

From the CVE record

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.

In plain language

Written by AI from the record

Docker Sandboxes on macOS before version 0.42.0 can let a malicious program inside a sandbox change files on the Mac, so affected businesses should update now.

A symlink-following flaw in the virtio-fs stored-path fallback allows a guest with control of the Docker Sandbox operating system to escape its shared workspace and write arbitrary macOS host files as the VMM user.

If you're affected

Mac file tampering
Host device takeover
Data loss or exposure
Business disruption

What is it

This is a boundary failure between a Docker Sandbox and the Mac running it. It is like giving a contractor access to one storage room, then finding they can use a misleading sign to unlock and alter files throughout the whole building.

Who is affected

This matters to you if your business runs Docker Sandboxes on macOS. The attacker must already be able to control the operating system inside a Docker Sandbox; the risk applies when Docker Sandboxes uses the virtio-fs host server in its default configuration.

How urgent is it

An attacker who controls a sandbox can use this flaw to alter files on the Mac that hosts it, potentially taking control of that device. There is no reported real-world exploitation and no public exploit code, but the host-escape impact makes this a red-priority update.

What to do — in detail

Inventory Macs running Docker Sandboxes and record the installed version; systems before 0.42.0 should be treated as affected.
Upgrade Docker Sandboxes to 0.42.0 or later. No branch-specific fixed versions or breaking-change notes are provided in the findings.
If an immediate upgrade is not possible, run sandboxes with --clone mode and remove or avoid extra read-write host mounts, following Docker's guidance: https://docs.docker.com/ai/sandboxes/usage/#clone-mode
Restrict who can run or administer code inside existing sandboxes until remediation is complete, because guest control is the prerequisite for this attack.
Check for unexpected changes to important macOS host files and investigate suspicious sandbox activity. CISA has not added this CVE to KEV, so no CISA remediation due date is listed.

Technical context

CVE-2026-77179 is CWE-59 (improper link resolution) affecting Docker Sandboxes on macOS that use the virtio-fs host server. The attack vector is local, from guest to host: a guest attacker can replace a parent directory with a symlink during the stored-path fallback and cause an unlinked file to be reopened outside the shared workspace, allowing arbitrary host-file read/write as the VMM user and possible host code execution. Authentication and user interaction are not required once the attacker controls the guest OS. It is not in CISA KEV; reporting identifies no in-the-wild exploitation, and no public exploit code is recorded. EPSS is 0.2% (6th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS9th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 9th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 1 day, from the signal feeds we watch.

2026-09-16Workaround availablerecord updated
2026-09-15Workaround availableworkaround available, published, weakness classified, att&ck mapped, record updated, record updated