CVE-2025-26675 Overview
CVE-2025-26675 is an out-of-bounds read vulnerability in the Windows Subsystem for Linux (WSL). An authenticated local attacker can exploit the flaw to elevate privileges on affected Windows and Windows Server systems. The vulnerability is tracked under [CWE-125] and affects multiple supported versions of Windows 10, Windows 11, and Windows Server. Microsoft addressed the issue in its April 2025 security update cycle.
Critical Impact
A local, authenticated attacker can read memory outside intended bounds within WSL components, enabling privilege escalation with high confidentiality, integrity, and availability impact.
Affected Products
- Microsoft Windows 10 21H2 and Windows 10 22H2
- Microsoft Windows 11 22H2, 23H2, and 24H2
- Microsoft Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025
Discovery Timeline
- 2025-04-08 - CVE-2025-26675 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-26675
Vulnerability Analysis
The vulnerability resides in the Windows Subsystem for Linux, a compatibility layer that runs Linux binaries natively on Windows. WSL bridges user-mode Linux processes with Windows kernel services through a set of drivers and helper components. An out-of-bounds read condition in this bridging logic allows a locally authenticated attacker to access memory outside allocated buffers.
Successful exploitation leads to local privilege escalation, giving the attacker elevated rights on the host operating system. Because the flaw requires local access and low privileges, it is well-suited as a second-stage capability after initial access through phishing, credential theft, or another local foothold.
The issue is classified as [CWE-125] Out-of-bounds Read. Read-based memory disclosure primitives are often chained with additional flaws to bypass mitigations such as Kernel Address Space Layout Randomization (KASLR) or to leak sensitive tokens used for privilege elevation.
Root Cause
Microsoft attributes the issue to improper bounds checking within a WSL component. The affected code path reads beyond the boundaries of an allocated buffer, exposing adjacent memory contents to the caller. Microsoft has not released detailed root-cause technical documentation beyond the advisory.
Attack Vector
The attack vector is local. An attacker must already have valid credentials and the ability to execute code on the target system, typically as a low-privileged user with WSL enabled or invocable. The attacker then triggers the vulnerable WSL code path to leak memory and pivot to a higher-privileged context on the Windows host.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2025-26675 advisory for technical specifics.
Detection Methods for CVE-2025-26675
Indicators of Compromise
- Unexpected wsl.exe, wslhost.exe, or wslservice.exe process launches by non-administrative users on systems where WSL is not part of normal workflows.
- Anomalous child processes spawned from WSL components running with elevated integrity levels or SYSTEM tokens.
- Crash dumps or Windows Error Reporting events referencing WSL binaries and drivers such as lxcore.sys or lxss.sys.
Detection Strategies
- Hunt for local privilege escalation patterns where a standard user account launches WSL processes followed by token manipulation or access to protected resources.
- Correlate WSL activity with subsequent creation of new local administrator accounts, scheduled tasks, or service installations.
- Baseline which endpoints legitimately use WSL and alert on first-time WSL invocation on systems outside that baseline.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) with command-line logging for WSL-related binaries and monitor for unusual invocation patterns.
- Ingest endpoint telemetry into a SIEM or data lake for behavioral correlation between WSL execution and privilege escalation indicators.
- Track Microsoft patch compliance for the April 2025 security update on all Windows 10, Windows 11, and Windows Server hosts in scope.
How to Mitigate CVE-2025-26675
Immediate Actions Required
- Apply the April 2025 Microsoft security update that addresses CVE-2025-26675 across all affected Windows 10, Windows 11, and Windows Server systems.
- Inventory endpoints and servers where WSL is installed or optionally enabled and prioritize those hosts for patching.
- Restrict local interactive logon rights and remove unnecessary local users to reduce the pool of accounts capable of exploiting local privilege escalation flaws.
Patch Information
Microsoft has released fixes through its standard security update channels. Consult the Microsoft Security Update CVE-2025-26675 advisory for the specific KB articles and update packages corresponding to each affected Windows build.
Workarounds
- Where WSL is not required, disable the Microsoft-Windows-Subsystem-Linux and VirtualMachinePlatform optional features until systems can be patched.
- Use application control policies such as Windows Defender Application Control (WDAC) or AppLocker to block execution of WSL binaries for non-administrative users.
- Enforce least-privilege access and Just-In-Time administration to limit the ability of standard users to run WSL on production servers.
# Disable WSL and Virtual Machine Platform features on hosts that do not require them
Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux -NoRestart
Disable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -NoRestart
# Verify current feature state
Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
