This vulnerability (CVE-2026-21242) involves a use-after-free condition in the Windows Subsystem for Linux component of Windows 10 Version 21H2 (build 10.0.19044.0). Exploitation requires local access with authorized privileges and can result in privilege escalation. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity and low privileges, but no user interaction. Successful exploitation impacts confidentiality, integrity, and availability with high severity. Microsoft has published an official fix to remediate this vulnerability.

An authorized local attacker can exploit this use-after-free vulnerability to elevate their privileges on the affected Windows 10 system. This can lead to full compromise of system confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Microsoft has released an official patch to address this vulnerability. Users and administrators should apply the provided security update from the Microsoft Security Response Center as soon as possible to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.