This vulnerability is a TOCTOU race condition in Windows Subsystem for Linux (WSL2) that could allow an authorized local attacker to tamper with system resources by exploiting the timing gap between the check and use of a resource. The CVSS 3.1 vector indicates the attack requires local access with low privileges and high attack complexity, no user interaction, and impacts confidentiality and integrity but not availability. Microsoft has published an official fix for this issue.

An authorized local attacker could exploit this race condition to tamper with system resources, potentially leading to unauthorized disclosure or modification of data within WSL2. The vulnerability does not affect availability and requires local access with low privileges and high attack complexity.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft security update referenced in the vendor advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57973) to remediate this vulnerability.