The vulnerability is a use‑after‑free in the Windows Subsystem for Linux (WSL) component, allowing a local actor to trigger memory corruption and obtain higher privileges on the host. By manipulating WSL task cleanup routines, a compromised process can acquire full system control.

Microsoft Windows 10 version 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2022 and 2025 (including Server Core) on supported x86, x64 and ARM64 architectures. These builds contain the vulnerable WSL implementation as identified in the Microsoft advisory.

The CVSS base score of 7.8 indicates a high risk of successful local privilege escalation, but the flaw requires authenticated or otherwise authorized local access and does not provide a remote attack path. The EPSS score is not available, so evidence of active exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to log into a system that runs WSL and execute crafted code to exploit the use‑after‑free, potentially escalating to full control of the machine.