EUVD-2026-44280
GHSA-32j5-g8f9-jjh7
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Local-only TOCTOU race requires low privileges and precise timing (AC:H); tampering yields high integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.
AnalysisAI
Tampering via a time-of-check time-of-use (TOCTOU) race condition in Windows Subsystem for Linux 2 (WSL2) enables a locally authorized, low-privileged attacker to manipulate file system or resource state between the moment a security check is performed and the moment the resource is actually used. Affected versions run below 2.7.10, and Microsoft has released a fix. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the SSVC framework assesses technical impact as total if the race is won, making the integrity risk significant despite a medium CVSS score.
Technical ContextAI
WSL2 (cpe:2.3:a:microsoft:windows_subsystem_for_linux_(wsl2):*:*:*:*:*:*:*:*) is Microsoft's virtualization-based Linux compatibility layer, running a real Linux kernel inside a lightweight Hyper-V utility VM. CWE-367 (TOCTOU Race Condition) describes the class of defect where a program reads a resource's state to make a security or access decision, then acts on the resource in a separate, non-atomic operation - leaving a window in which another thread or process can swap the resource's identity or content. In WSL2's architecture, the interplay between the Windows NT object manager, the Plan 9 file-system protocol (9P) used for host filesystem bridging, and the Linux VFS layer creates multiple TOCTOU-susceptible boundaries. The high attack complexity (AC:H) in the CVSS vector reflects that winning the race requires precise timing, often demanding repeated attempts or specialized tooling to reliably exploit.
RemediationAI
The primary fix is to upgrade Windows Subsystem for Linux 2 to version 2.7.10 or later, as released by Microsoft and documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57973. WSL2 can be updated via the Microsoft Store (if installed from there) or by running 'wsl --update' from an elevated command prompt followed by 'wsl --shutdown' and restarting the subsystem. As a compensating control where immediate patching is not possible, administrators can restrict which users are permitted to run WSL2 instances via AppLocker or Windows Defender Application Control policies - this does not eliminate the vulnerability but limits the pool of potential attackers to those already holding elevated access, narrowing real-world risk. Disabling WSL2 entirely ('wsl --set-default-version 1' or removing the WSL2 optional feature) eliminates the attack surface at the cost of losing Linux kernel compatibility; WSL1 is not confirmed affected by this specific TOCTOU path. No patch version conflict with WSL1 is expected.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today