{"id":"CVE-2026-119846","kind":"vulnerability","aliases":["CVE-2026-119846"],"related":[],"title":"Windows Subsystem for Linux: out-of-bounds read lets a local user gain privileges","description":"Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.","summary":"Windows Subsystem for Linux has an out-of-bounds read flaw that lets an already-authorized local user raise their privileges. The attacker needs a local account on the affected Windows machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows","wsl"],"not_affected_if":["no-local-users","wsl-not-installed"],"how_to_check":"- Check whether WSL is installed by running `wsl --version` in a Windows terminal\n- Compare the installed WSL version against the fixed version in Microsoft's advisory for CVE-2026-119846 (unknown in the sources)","fix":null,"status":"open","published_at":"2026-11-10T19:20:01+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","triaged_at":"2026-11-10T19:40:25+00:00","updated_at":"2026-11-10T19:40:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:40:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Subsystem for Linux: out-of-bounds read lets a local user gain privileges","impact":"high","summary":"Windows Subsystem for Linux has an out-of-bounds read flaw that lets an already-authorized local user raise their privileges. The attacker needs a local account on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","wsl"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the Windows machine","analyst_note":"Confirm affected WSL versions and the Microsoft fixed build from the Microsoft Security Response Center advisory for CVE-2026-119846.","how_to_check":"- Check whether WSL is installed by running `wsl --version` in a Windows terminal\n- Compare the installed WSL version against the fixed version in Microsoft's advisory for CVE-2026-119846 (unknown in the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["wsl-not-installed","no-local-users"],"who_is_affected":"Machines running Windows Subsystem for Linux where an authorized user can already log on locally. Machines without WSL installed, and servers with no local interactive users, are less exposed. The sources do not name the affected WSL versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4496,"output_tokens":517,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected WSL versions and the Microsoft fixed build from the Microsoft Security Response Center advisory for CVE-2026-119846.","search":"'-119846':18A,21A '-2026':17A,20A 'account':53B 'affect':56B 'allow':69C 'alreadi':41B 'already-author':40B 'attack':49B,72C 'author':42B,71C 'bound':8A,34B,62C 'cve':16A,19A 'elev':74C 'flaw':36B 'gain':14A 'infrastructur':22B 'let':10A,38B 'linux':4A,28B,68C 'local':12A,43B,52B,76C 'machin':58B 'need':50B 'out-of-bound':5A,31B,59C 'privileg':15A,47B,75C 'rais':45B 'read':9A,35B,63C 'subsystem':2A,26B,66C 'user':13A,44B 'window':1A,23B,25B,57B,65C 'wsl':24B","nicknames":[],"mitigations":[],"who_affected":"Machines running Windows Subsystem for Linux where an authorized user can already log on locally. Machines without WSL installed, and servers with no local interactive users, are less exposed. The sources do not name the affected WSL versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows","wsl"],"campaign_type":null,"search_a":"'-119846':18A,21A '-2026':17A,20A 'bound':8A 'cve':16A,19A 'gain':14A 'let':10A 'linux':4A 'local':12A 'out-of-bound':5A 'privileg':15A 'read':9A 'subsystem':2A 'user':13A 'window':1A","search_b":"'account':53B 'affect':56B 'alreadi':41B 'already-author':40B 'attack':49B 'author':42B 'bound':34B 'flaw':36B 'infrastructur':22B 'let':38B 'linux':28B 'local':43B,52B 'machin':58B 'need':50B 'out-of-bound':31B 'privileg':47B 'rais':45B 'read':35B 'subsystem':26B 'user':44B 'window':23B,25B,57B 'wsl':24B","search_c":"'allow':69C 'attack':72C 'author':71C 'bound':62C 'elev':74C 'linux':68C 'local':76C 'out-of-bound':59C 'privileg':75C 'read':63C 'subsystem':66C 'window':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119846","severity":null,"published_at":"2026-11-10T19:20:01+00:00","modified_at":"2026-11-10T19:20:01+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","fetched_at":"2026-11-10T19:24:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}