Microsoft WSL CVE-2026-96309

Exploitation requires the Windows Subsystem for Linux component/feature to be present and in use on the target, plus prior local authenticated access with at least low-privileged code-execution capability (PR:L) to invoke the vulnerable WSL code path and trigger the use-after-free. Limiting factors that reduce realistic risk: there is no network vector (AV:L) and no remote entry point, no unauthenticated path (an existing local account/foothold is mandatory), and WSL is an optional Windows feature that must be installed/enabled - hosts without WSL are not exposed. No user interaction is required (UI:N), and attack complexity is low (AC:L), so once a local foothold and WSL exist, reliable triggering is plausible.

All signals align on a moderate-to-serious local privilege-escalation issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity, low-privilege attack with no user interaction and full CIA impact on the host - a classic elevation-of-privilege profile for a kernel/subsystem use-after-free. There is NO CISA KEV listing, NO public exploit identified, and NO EPSS score provided in the input, so there is no evidence of active or imminent widespread exploitation; this is a priority for timely patching but not a drop-everything network-exploitable crisis. The required local authenticated foothold (PR:L) and lack of any network vector sharply limit real-world reach compared to a remote CVSS-7.8 flaw. One minor conflict to verify: the input Tags include 'Denial Of Service,' yet the description and the C:H/I:H/A:H vector both frame this as privilege elevation with full impact, so DoS is at most a secondary effect, not the primary risk - treat the EoP framing as authoritative.

A local attacker who already has a low-privileged foothold on a Windows machine with WSL present runs a crafted program that manipulates WSL object lifetimes to trigger the use-after-free, reclaiming the freed memory to corrupt kernel/subsystem state and execute code at a higher privilege level. No public exploit code was identified at the time of analysis, so weaponization would require independent development. No user interaction or network access is needed, but the attacker must first obtain local code execution.