Windows Subsystem for Linux: Use-after-free leads to local privilege escalation

Summary

A use-after-free vulnerability in the Windows Subsystem for Linux (WSL) allows an authorized local user to elevate privileges on the affected Windows system. Exploitation requires a logged-on account or code execution on the host, and the attack complexity is high. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33822
• Source: CVE record. The list is not yet verified against the vendor advisory.

Fixed in

• Fixes are listed in the CVE record as builds 10.0.19044.7846 and later, 10.0.19045.7846 and later, 10.0.22631.7711 and later, and so on, per the affected list.
• KB numbers: Unknown. Check the Microsoft Security Update Guide for the exact update per Windows version.

Workaround

Unknown. No vendor workaround found.

• Limit local logon on shared hosts.
• Restrict who can install or enable WSL.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Open the Microsoft Security Update Guide entry and record the exact fixed builds and KB numbers for each Windows version in use.
• Inventory hosts with WSL enabled and their Windows builds.
• Install the Windows updates in the next maintenance window, prioritising hosts with WSL and multiple local users.
• Restrict local logon and WSL installation on shared systems until patched.
• Re-check NVD and the vendor page for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-88237 www.cve.org
• Microsoft Security Update Guide CVE-2026-88237 msrc.microsoft.com
• VulDB entry CVE-2026-88237 vuldb.com
• Strix CVE-2026-88237 (secondary aggregator) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:12.