Microsoft has released Windows Subsystem for Linux 2.7.14. The update bundles four major backported fixes addressing uninitialized memory leaks, out-of-bounds reads in interop messages, network exposure on the kernel daemon relay, and authorization bypasses in plugin mounts. By maintaining a dedicated release/2.7 branch for these hardening updates, the WSL team ensures stability without interrupting active feature development on the master track. You can apply the patch immediately by running wsl --update in PowerShell to secure your existing distributions without any manual intervention.

Microsoft Ships WSL 2.7.14, a Security-Focused Servicing Release for Windows Subsystem for Linux

The latest patch bundles four critical fixes for memory safety, network exposure, and input validation flaws, arriving just one day after WSL 2.7.13.

Microsoft just shipped WSL 2.7.14, a purely defensive patch for the Windows Subsystem for Linux. There are no new features here. The release bundles four backported fixes addressing uninitialized memory, network exposure, input validation flaws, and race conditions during uninstallation. You'll get the full breakdown below.

You might remember that previous patch as the quick turnaround for an MDE plugin startup failure. Microsoft is clearly treating the release/2.7 branch as a dedicated hardening track. There are roughly 623 commits ahead on master right now, meaning the team is actively developing new features there while the servicing branch stays focused on stability.

The Patches Under the Hood

The first fix tackles a classic memory safety oversight. Several aggregate message structures in the init subsystem were declared without value-initialization. That left struct padding and unassigned fields holding whatever garbage happened to sit in memory. The patch applies consistent zero-initialization across seven core files, including WslCoreVm.cpp and interop.cpp. It stops uninitialized data from leaking over inter-process communication channels between the Linux init subsystem and the Windows service VM.

The second patch is the heavy lifter. It consolidates five upstream security fixes into a single backport PR. NUL-termination validation now wraps all flexible-array buffer access. Malformed interop messages can no longer trigger out-of-bounds reads past the allocated buffer. The kernel daemon relay (wslrelay) used to listen on all network interfaces. That exposed it to remote connections. The fix pins it to loopback only.

Microsoft also bumped the bundled .NET runtime from 10.0.9 to 10.0.11, catching July and August security servicing updates. Importing distributions now uses bounds-checked span::subspan() calls instead of trusting the message-supplied size field. Finally, the uninstall routine disables the service before stopping it, closing a window where another process could restart it and leave orphaned state behind.

Plugin folder mounts previously relied on an HCS-managed Plan9 server that accessed host paths using the service identity. Your per-user Windows file permissions were effectively ignored. The new release spins up a dedicated per-user Plan9 server on port 50006 just for plugin mounts. Existing GPU shares keep using the old path. Guest capability strings also get validated now. The code bounds kernel version parsing to the received message span, which blocks potential buffer over-reads if a misconfigured Linux kernel sends back garbage.

Head here to check the full release notes and pull requests on the official WSL GitHub repository.