WSL2 CVE-2026-85879

Requires the Windows Subsystem for Linux (WSL2) optional feature to be installed and in use on the host, affecting WSL2 versions 5.0.0.0 up to (but not including) 2.7.10. The attacker must already have authenticated local access as a low-privileged user (PR:L) to run code on the machine and interact with the vulnerable WSL operation. Exploitation is limited by high attack complexity (AC:H): the TOCTOU race window must be won through precise timing, which CISA SSVC marks as not automatable, making reliable exploitation difficult; no user interaction by a victim is required (UI:N).

This is a genuine but moderate-priority local privilege escalation, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0 High) describes a locally-exploitable flaw requiring an already-authenticated low-privileged user and a high-complexity attack - the AC:H reflects the inherent unreliability of winning a TOCTOU race (CWE-367). Multiple signals point the same direction: CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' (races are hard to weaponize reliably), while still scoring Technical Impact as 'total' (consistent with full C:H/I:H/A:H compromise of the subsystem). There is no CISA KEV listing and no POC was provided, so exploitation is theoretical today. The EPSS probability was not supplied in the input and cannot be stated. In short, the signals are internally consistent rather than conflicting: high technical impact but low practical exploitability and no evidence of in-the-wild use - this is a patch-in-normal-cycle issue for environments that run WSL, not an actively-exploited threat. One metadata caveat: the input Tags label this 'Information Disclosure,' which conflicts with the description (privilege elevation) and the full C/I/A impact - treat the tag as suspect.

A local, low-privileged user who can already run code on a Windows host with WSL2 installed repeatedly triggers a privileged WSL operation while swapping the checked resource between the time-of-check and time-of-use window, eventually winning the race to act with elevated privileges. Because the attack is local and high-complexity (AV:L/AC:H), the attacker likely needs many attempts and precise timing, and no public exploit code was identified at time of analysis.