Windows Subsystem For Linux (Microsoft) - vulnerabilities (CVEs)

10 CVEs, 3 in the last 30 days, 116 known versions, newest CVE from 2026-10-13. Vendor: Microsoft.

CVEs of Windows Subsystem For Linux

• CVE-2026-102204 - CVSS 7.8 (high), 2026-10-13: Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
• CVE-2026-96206 - CVSS 6.5 (medium), 2026-10-13: Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
• CVE-2026-85879 - CVSS 7 (high), 2026-10-13: Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
• CVE-2026-57973 - CVSS 6.3 (medium), 2026-07-14: Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.
• CVE-2026-57968 - CVSS 7.8 (high), 2026-07-14: Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
• CVE-2025-62220 - CVSS 8.8 (high), 2025-11-11: Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network.
• CVE-2025-53788 - CVSS 7 (high), 2025-08-12: Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
• CVE-2022-44689 - CVSS 7.8 (high), 2022-12-13: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
• CVE-2022-38014 - CVSS 7 (high), 2022-11-09: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
• CVE-2021-43907 - CVSS 9.8 (critical), 2021-12-15: Visual Studio Code WSL Extension Remote Code Execution Vulnerability