A use‑after‑free flaw in Windows Subsystem for Linux allows an attacker who already has local access to a user account to gain higher privileges on the host operating system. The vulnerability is a classic memory corruption issue (CWE‑416) that can be abused to execute arbitrary code as a privileged user after the memory has been freed.

Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1, and Windows Server 2022, Server 2025 and the 2025 Server Core installation, as well as the 2022 Server Core release. All listed builds are affected; the list does not include non‑Microsoft products.

The CVSS score of 7 indicates a medium‑to‑high impact. The EPSS score is below 1%, suggesting exploitation is currently unlikely. The vulnerability is not present in the CISA KEV catalog. The attack requires local authorized access and cannot be leveraged remotely. Once exploited, the attacker can acquire full control of the Windows host, enabling further malicious activity.