CVE-2026-96206: Windows Subsystem for Linux Information Disclosure Vulnerability
Published Oct 13, 2026
·Updated
Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
Other sources
Windows Subsystem for Linux Information Disclosure Vulnerability
— Microsoft
Affected Software
2 affected componentsFixes available
Microsoft Windows Subsystem For Linux
Microsoft Windows Subsystem for Linux (WSL2)<3.0.1
3.0.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.1
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
DescriptionSeverity
Frequently Asked Questions
1
What level of access does an attacker need?
An attacker must already be authorized on the affected system and able to act locally. The vulnerability is not described as remotely exploitable.
2
What is the expected impact if exploitation succeeds?
Successful exploitation can disclose information. The provided assessment does not indicate an integrity or availability impact.