An uninitialized resource within the Windows Subsystem for Linux (WSL2) allows a local, authorized attacker to read sensitive data. The flaw occurs when the subsystem fails to initialize a data structure before use, enabling the attacker to discover information that should otherwise be protected. The impact is limited to disclosure of data on the affected machine, but can expose configuration secrets or operational details that could assist in further attacks; the flaw is not exploitable for remote code execution or privilege escalation at this time.

Microsoft Windows Subsystem for Linux (WSL2) on Windows. Specific version information is not provided, so all installations of WSL2 are considered potentially affected until a vendor‑issued patch is applied.

The CVSS score of 6.5 indicates a moderate severity vulnerability. No EPSS value is available, and the flaw is not reported in the CISA KEV list. The attack vector is local and requires the attacker to have authorized user access to the host system. Because the flaw only permits information disclosure, the immediate threat is limited but can facilitate downstream attacks if sensitive data is accessed.