CVE-2026-102204
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker with local access may elevate their privileges on the system, potentially leading to further host compromise. This requires prior authorized access.
Recommendation
Apply Windows updates containing the fix for Windows Subsystem for Linux. Restrict local access to untrusted users and monitor for privilege escalation attempts.
Other vulnerabilities in Windows Subsystem for Linux
See all- CVE-2017-8622High
The vulnerability in Windows Subsystem for Linux in Windows 10 1703 allows for elevation of privilege when it fails to properly handle NT pipes handles.
- CVE-2026-96309High
Use-after-free vulnerability in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
- CVE-2026-96206Medium
A use of uninitialized resource vulnerability in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
- CVE-2026-85879High
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
- CVE-2026-70027High
Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
- CVE-2026-57973Medium
A TOCTOU race condition in Windows Subsystem for Linux (WSL) allows an authorized attacker to perform local tampering. The vulnerability stems from a race between resource check and use.
- CVE-2026-57968High
A buffer over-read vulnerability in Windows Subsystem for Linux (WSL) allows an authorized attacker to elevate privileges locally.
- CVE-2021-36966High
Vulnerability in Windows Subsystem for Linux allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges on the system.
- CVE-2020-1075Medium
Information disclosure vulnerability in Windows Subsystem for Linux due to improper handling of objects in memory. An attacker could obtain information to further compromise the user's system.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

