CVE-2026-21237CWE-362CWE-416

Windows Subsystem for Linux Elevation of Privilege Vulnerability

High · published February 10, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

⚡ A privilege escalation opportunity is lurking in the Windows Subsystem for Linux! An authorized attacker can exploit this race condition to gain elevated access. 🔥 Think of it like two construction crews trying to use the same elevator at the same time without communicating. If one crew reaches the top floor first, they can seize control of the entire building before the other even knows what's happening! If exploited, an attacker can elevate their privileges, effectively taking over local resources and potentially accessing sensitive information or executing harmful commands. This could lead to a devastating breach of security and control over the system.

Put simply

Think of it like two construction crews trying to use the same elevator at the same time without communicating. If one crew reaches the top floor first, they can seize control of the entire building before the other even knows what's happening! This vulnerability arises from improper synchronization during concurrent execution when accessing shared resources in the Windows Subsystem for Linux, allowing authorized users to create a race condition that leads to privilege escalation.

What to do

If exploited, an attacker can elevate their privileges, effectively taking over local resources and potentially accessing sensitive information or executing harmful commands. This could lead to a devastating breach of security and control over the system. To protect your systems, ensure you apply the latest security updates from Microsoft that address this vulnerability. Regularly monitor your systems for unauthorized access and review user permissions to minimize risks. Stay informed on patch management best practices. You've got this! With a little vigilance and timely updates, your system can be fortified against this threat. 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00273 · 18.7th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Windows Subsystem for Linux Elevation of Privilege Vulnerability
    cvelistv5