CVE-2025-53788

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-53788

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53788.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-53788

Published

2025-08-12T18:15:47Z

Modified

2026-07-09T17:10:57Z

Severity

7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53788

Affected packages

Git / github.com/microsoft/wsl

Affected ranges

Type

GIT

Repo

https://github.com/microsoft/wsl

Events

Introduced

Fixed

642331364dda7a3d88bf64acb87e7056918a5fc9

Database specific

Show details

{
    "cpe": "cpe:2.3:a:microsoft:windows_subsystem_for_linux:*:*:*:*:*:-:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.10"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*

0.47.1

0.48.2

0.50.2

0.51.0

0.51.2

0.51.3

0.56.1

0.56.2

0.58.0

0.58.1

0.58.3

0.60.0

0.61.4

0.61.5

0.61.8

0.64.0

0.65.1

0.65.2

0.65.3

0.66.2

0.67.6

0.68.2

0.68.4

0.70.0

0.70.4

0.70.5

0.70.8

1.*

1.0.0

1.0.1

1.0.3

1.1.0

1.1.2

1.1.3

1.1.5

1.1.6

1.1.7

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.3.10

1.3.11

1.3.14

1.3.15

1.3.17

2.*

2.0.0

2.0.1

2.0.11

2.0.12

2.0.14

2.0.15

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1.0

2.1.1

2.1.3

2.1.4

2.1.5

2.2.1

2.2.2

2.2.3

2.2.4

2.3.11

2.3.12

2.3.13

2.3.14

2.3.17

2.3.21

2.3.22

2.3.24

2.3.25

2.3.26

2.4.10

2.4.11

2.4.12

2.4.13

2.4.4

2.4.5

2.4.8

2.4.9

2.5.1

2.5.4

2.5.6

2.5.7

2.5.8

2.5.9

2.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53788.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "144351363540916962175720344345521334679",
                "245042208414307992312668927386180916863",
                "331119021619891010807544431869826506063"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-0606732a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/util.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "253988201085267074192636480310766550360",
                "170504893359793545731565359389421624668",
                "238139913590976123330789239653327202965",
                "94214089993440506234943882249879545932",
                "314389919177029583886247601360500159042",
                "264284157345498683090799361100029937577",
                "129799249776663946547496919368538052223",
                "26674328291475577568044675213015988820"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-173b29c6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/util.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "97270596252963485877884731518205513933",
                "262583080821472126375503558283384611888",
                "245507906508433744405277029271086635926",
                "325618177134934049613206468491853861422",
                "250701047673623118007939115840614566090",
                "220790357315402549626414756440473268507",
                "182683716929026680284098873676417283567",
                "254834547922941729928122993277398846330",
                "215012641606546328072654703050851294846",
                "199796709601296611475318142501976839372"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-2401f557",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/shared/inc/lxinitshared.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "318261986875556312665253099280489505041",
                "92835816081386461954644267482407143345",
                "49552906990650810887183195895981728748",
                "227555406329809816332420385180950897233",
                "59199408224944206889232433279046474868",
                "95381287350783441985310993194881829816",
                "249006846548633633816774945521894634069",
                "290254392762336989777553131510796328751",
                "254286858754563561838784281454943543275",
                "54654782238828110207362897981118325329"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-4e33f675",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/wslinfo.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36275194083451750975909955831238134326",
                "318745895047823855166348581484783072060",
                "145823020405696323034625598900437813406"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-57e92abc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/main.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "24225936585815133443452261174953347224",
            "length": 5472
        },
        "id": "CVE-2025-53788-830e01c3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/init.cpp",
            "function": "InitEntryUtilityVm"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "85830664735761727792394087875383238784",
                "22823219507482606946597331497475682918",
                "281287687693098470322112983828894843762",
                "251458520647117968934026789048274011182",
                "121488282819637174461263450230789280314",
                "147413884932747247511642624480879127754",
                "169951972241895939234106182745853440797",
                "19268597284630365561103016378575244044",
                "128773435338202441822755082960504929197",
                "220771883747682407921588371130045314494",
                "3494712490517583595877970501795918329"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-b0b7699e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/config.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "44576310600471774789503016168333196433",
            "length": 2712
        },
        "id": "CVE-2025-53788-b2cd90d0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/wslinfo.cpp",
            "function": "WslInfoEntry"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "14742762894413069304501403435411284466",
                "13962037740178426415748669501985687388",
                "111160892026235663405730912414623257107",
                "78561314777973834405480978150354730479",
                "265177705692662497175168552094762610097",
                "272007530325417549038244206481998390740",
                "159879605859878946641007383607441287570",
                "310128003816994300338097229701564424579",
                "62263096897244153573266435805233312396"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-cd6836a2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/init.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "255542120492722093158208438838705276733",
                "97672974380381118841480136243172028154",
                "178742590169936861193906859486436053405",
                "243626084922795361204131095756564882422",
                "298746086714456249759289617024900281056",
                "183607991837278020937664593547611298311",
                "106591409120628263923004335439860965431",
                "146262304391011426631836521846608509382",
                "99926473348928573657597894140755792980",
                "315579414541910332207799496342626812226"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-f4becc4d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "test/windows/UnitTests.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "69134782822009972396582816770580303376",
            "length": 1130
        },
        "id": "CVE-2025-53788-f55efa40",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/config.cpp",
            "function": "ConfigCreateEnvironmentBlock"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "25110055518475840185199716953646967516",
                "316957314939402100760123871956843802477",
                "131022024431547884828685578611263726899",
                "320545624545284599486990026909438669113"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-53788-f6295b94",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/wsl/commit/642331364dda7a3d88bf64acb87e7056918a5fc9",
        "target": {
            "file": "src/linux/init/WslDistributionConfig.h"
        }
    }
]

vanir_signatures_modified

"2026-07-09T17:10:57Z"