EUVD-2026-44279
GHSA-ffj6-89cj-pgr8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP needing an existing standard-user foothold gives AV:L/PR:L, no bounds or interaction hurdles gives AC:L/UI:N, and successful elevation yields full C/I/A high with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL2) allows a low-privileged authenticated user on the Windows host to elevate to higher privileges by triggering a buffer over-read (CWE-126). Microsoft (the reporting vendor) has released a fix via MSRC, and there is no public exploit identified at time of analysis. With a CVSS 3.1 base score of 7.8 and full high impact to confidentiality, integrity and availability, it is a meaningful local EoP but requires prior code-execution access on the machine.
Technical ContextAI
Windows Subsystem for Linux (WSL2) runs a real Linux kernel inside a lightweight utility VM and bridges it to the Windows host through a privileged virtualization and interop layer (the WSL service, 9p file-sharing, and interop pipes running under elevated context). CWE-126 (Buffer Over-read) indicates the flaw stems from code reading past the end of an allocated buffer - typically parsing untrusted length-prefixed or improperly bounds-checked input crossing the guest/host boundary. Because part of the WSL stack executes with higher privilege than the invoking user, an over-read that leaks memory or corrupts control flow in that component can be leveraged for privilege elevation. The affected component per CPE is cpe:2.3:a:microsoft:windows_subsystem_for_linux_(wsl2), i.e. the WSL2 application/service layer rather than the Windows NT kernel itself.
RemediationAI
Patch available per vendor advisory: apply the Microsoft-released update referenced in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57968 (exact fixed version not enumerated in the provided data - obtain it from the MSRC page). Because WSL2 now ships as a Microsoft Store / standalone package in addition to the optional Windows feature, ensure the WSL application itself is updated (for example via 'wsl --update' or Store/enterprise deployment channels) rather than relying solely on monthly OS cumulative updates. Where patching must be deferred, reduce exposure by uninstalling or disabling the WSL feature on hosts that do not require it and by restricting which users can launch WSL, which removes the local attack surface at the cost of losing Linux interop for those users; on shared or multi-user machines, limit interactive local logon to trusted accounts since exploitation requires existing local code execution.
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today