Microsoft Windows Subsystem for Linux: Elevation of privilege via out-of-bounds read

Summary

An out-of-bounds read in the Windows Subsystem for Linux (WSL) allows an authorized local user with low privileges to elevate their privileges on the system. The flaw has a CVSS 3.1 base score of 7.8 (high), with high impact on confidentiality, integrity and availability. Exploitation requires local access and a valid account; it is not reachable remotely or without authentication.

Affected

• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2019 and Server Core installation (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)
• Windows Server 2025 and Server Core installation (10.0.26100.0 to before 10.0.26100.33822)
• Note: The affected list was verified only partially against the primary record; Windows 10 1809 and the Server entries should be checked on MSRC.

Fixed in

• Build numbers from the vendor record: 10.0.17763.9487 (Windows 10 1809 and Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2 and Server 2025 client build), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022), 10.0.26100.33822 (Server 2025).
• The November 2026 cumulative updates are the likely fix vehicle (KB5132061 and KB5132059 mentioned by third parties, not confirmed by the vendor).
• No WSL package version is confirmed for this CVE.

Workaround

Unknown.

• No vendor-stated workaround was found.

Exploitation

• Microsoft's CVE.org record rates exploit code maturity as unproven (E:U).
• A third-party aggregator marks the flaw as not exploited; this is not a primary source.
• No public proof of concept and no CISA KEV listing were found.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Install the November 2026 Windows cumulative updates on all affected systems, starting with hosts where WSL is installed and with multi-user or developer machines.
• Check the WSL package version on each host with 'wsl --version' and update with 'wsl --update' where applicable.
• Inventory hosts with the WSL optional feature enabled and disable it where it is not needed.
• Restrict local logons on shared machines and monitor for unusual privilege changes.
• Verify the affected version list on the MSRC Update Guide before relying on it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-119846 msrc.microsoft.com
• CVE.org record (Microsoft CNA) www.cve.org
• Strix mirror CVE-2026-119846 www.strix.ai
• Senserva KB5132059 senserva.com
• Pureinfotech KB5132061 pureinfotech.com
• BleepingComputer KB5132061 and KB5131087 www.bleepingcomputer.com
• Wikipedia: Windows Subsystem for Linux en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:46.