An attacker who already has local user privileges can trigger a heap-based buffer overflow inside the Windows Subsystem for Linux (WSL). The overflow allows the attacker to execute code with elevated rights, effectively gaining root or system level authority on the host machine. This type of flaw directly compromises confidentiality, integrity, and availability because it lets a user circumvent normal security boundaries.

The vulnerability affects several Microsoft Windows releases, including Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2022 and Windows Server 2025 (including Server Core). All affected builds are listed in the vendor/product data.

The CVSS score of 7.8 indicates a moderate to high severity risk. Exploiting the vulnerability requires an attacker to be authenticated on the local system and to interact with the WSL environment, typically through a malicious package or crafted input. The EPSS score is not available, and the issue is not yet listed in the CISA KEV catalog, so the immediate public exploit evidence is limited. Nonetheless, the local and authorized nature of the attack vector means that any user with mundane privileges on a compromised machine could leverage it to gain higher-level access.