Microsoft WSL CVE-2026-70027

Exploitation requires the Windows Subsystem for Linux feature to be installed/enabled on the target host, plus pre-existing local authenticated access as a low-privileged user (PR:L) - WSL is not enabled in default Windows installations, which meaningfully limits the exposed population. The attacker must be able to run code locally to supply the malicious input that overflows the WSL heap; there is no network vector and no remote-trigger path. Limiting factors: local-only access (AV:L), the requirement for an existing authenticated foothold, and dependence on the optional WSL feature being present on the specific affected build ranges.

This is a locally-exploitable privilege-escalation flaw (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Windows Subsystem for Linux. The signals are internally consistent but point to moderate rather than urgent risk: the CVSS vector confirms local attack (AV:L) by an already-authenticated low-privileged user (PR:L) with low complexity and no user interaction, yielding total compromise (C:H/I:H/A:H). CISA's SSVC framework reinforces a non-urgent posture - Exploitation: none, Automatable: no, Technical Impact: total - meaning high impact IF exploited but no evidence of exploitation and no mass/automated exploitation path. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified at time of analysis. Net assessment: a legitimate patch-worthy local EoP (useful as a second-stage primitive after initial access), but not a drop-everything internet-facing emergency - prioritize it as part of normal Patch Tuesday remediation, elevated on developer workstations and multi-user hosts where WSL is enabled.

An attacker who has already gained low-privileged code execution on a Windows host with WSL enabled (e.g., via phishing or a compromised standard user account) runs a crafted program that triggers a heap-based buffer overflow in the WSL component. By corrupting heap memory, the attacker escalates from the standard user context to SYSTEM-level privileges, achieving full control of the machine. No public exploit identified at time of analysis, and the local-only vector means initial foothold is a prerequisite.