Microsoft Windows Subsystem for Linux: Elevation of privilege via use-after-free

Summary

A use-after-free vulnerability (CWE-416) in the Windows Subsystem for Linux (WSL) component of several Windows 10, Windows 11 and Windows Server versions allows an authorized local attacker to elevate privileges. The attacker needs a local account with low privileges and no user interaction is required. It is not directly reachable from the internet, but it matters on shared systems, terminal servers and developer workstations with WSL.

Affected

• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2: builds below 10.0.26100.9711
• Windows 11 Version 25H2: builds below 10.0.26200.9711
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows 11 Version 26H2: builds below 10.0.26300.9711
• Windows Server 2022: builds below 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds below 10.0.26100.33650

Fixed in

• Windows 10 21H2: build 10.0.19044.7807 (KB5126657, October 13, 2026)
• Other listed products: security updates from October 2026 with the build numbers above or higher
• Exact KB numbers for the other products: check the MSRC Security Update Guide
• Support scope: KB5126657 is documented for Windows 10 ESU and Windows 10 Enterprise and IoT Enterprise LTSC 2021. Coverage for Windows 10 21H2 Home or Pro is unknown.

Workaround

• Unknown. No workaround is documented in the sources reviewed.
• If WSL is not required on a host, removing or disabling it reduces exposure until the update is installed.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept found; EPSS 0.00000.
• One source lists a CISA KEV due date of 10/16/2026 next to this CVE; the KEV status is unclear and must be checked in the CISA KEV catalog.

Our recommendation

• Install the October 2026 Windows security update on all affected systems in the next patch cycle; prioritise shared machines, terminal or RDS servers and developer workstations using WSL.
• Identify Windows 10 21H2 devices and confirm their update path (ESU or LTSC); Windows 10 21H2 is past general support.
• Check the CISA KEV catalog and the MSRC advisory before finalising priority; raise to urgent if exploitation is confirmed.
• Review local accounts and privileges, and monitor for suspicious privilege escalation on hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96309 msrc.microsoft.com
• Microsoft KB5126657 (Windows 10 21H2/22H2 security update) support.microsoft.com
• Tenable plugin for KB5126657 www.tenable.com
• OpenCVE: CVE-2026-96309 app.opencve.io
• VulDB: CVE-2026-96309 vuldb.com
• Strix AI: CVE-2026-96309 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:54.