Executive brief
A security vulnerability exists in the Windows Subsystem for Linux (WSL2), a tool that allows developers to run Linux environments directly on Windows. An attacker who already has basic access to the system could exploit a timing issue to tamper with files or data they should not be able to modify. This could lead to unauthorized changes to system information or the exposure of sensitive data.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) exists in Microsoft Windows Subsystem for Linux (WSL2) versions 5.0.0.0 through 2.7.10. The vulnerability occurs when the system checks a file or resource property before performing an action, but the resource is modified by a malicious process in the interval between the check and the use. An attacker with local user privileges can exploit this high-complexity race condition to achieve unauthorized tampering and data disclosure. The issue is addressed in WSL2 version 2.7.10.
Affected products
- Microsoft Windows Subsystem for Linux (WSL2) 5.0.0.0 to 2.7.10
Timeline
- 2026-07-14: advisory: Initial disclosure by Microsoft and NVD
- 2026-07-14: patched: Fix identified in version 2.7.10