CVE-2026-21242CWE-416

Windows Subsystem for Linux Elevation of Privilege Vulnerability

High · published February 10, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

⚡ A clever slip lets any authorized user boost their privileges in the Windows Subsystem for Linux! Think of it as a trusted employee at a restaurant who finds a way to sneak into the kitchen and access the safe where all the secret recipes are stored—it's a recipe for disaster! If an attacker exploits this vulnerability, they could elevate their privileges and gain control over critical system resources, potentially wreaking havoc on the system. Imagine a low-level employee suddenly having the keys to the entire establishment—any data could be compromised, and security could be severely undermined.

Put simply

Think of it as a trusted employee at a restaurant who finds a way to sneak into the kitchen and access the safe where all the secret recipes are stored—it's a recipe for disaster! This vulnerability is a use-after-free flaw that occurs in the Windows Subsystem for Linux, allowing a local authorized attacker to manipulate memory and escalate their privileges without proper authorization.

What to do

If an attacker exploits this vulnerability, they could elevate their privileges and gain control over critical system resources, potentially wreaking havoc on the system. Imagine a low-level employee suddenly having the keys to the entire establishment—any data could be compromised, and security could be severely undermined. Immediately apply available patches from Microsoft for the Windows Subsystem for Linux to mitigate this risk. It's also wise to review user permissions and restrict access to the system where possible. You've got this! With the right patching and permission checks, you'll keep your systems safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00363 · 29.0th percentile
Weakness
CWE-416 · Use After Free
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Windows Subsystem for Linux Elevation of Privilege Vulnerability
    cvelistv5