The update matters for Docker hosts that process untrusted images, archives, and containers.
Moby 25.0.17 was released on August 13 with fixes for three vulnerabilities involving archive handling, copying files between the host and containers, and creating mount destinations.
CVE-2026-41567 concerns a specially crafted compressed archive, CVE-2026-42306 covers a symlink race that can replace a bind-mount target during docker cp, and CVE-2026-41568 addresses a symlink escape while a mount destination is being created.
The release also updates containerd to 1.7.33 to mitigate CVE-2024-40635. These issues do not amount to an unauthenticated remote escape from every container: the documented paths require additional conditions such as a malicious image, archive, or operator action.
Administrators running Docker Engine 25 should check the Moby version and vendor packages, prioritizing CI/CD hosts and systems that run third-party images, use the Docker Archive API, or regularly rely on docker cp.