I tried this on an airgapped machine that hasn't had any updates for a while and indeed was able to escalate.

I cannot reproduce this on my main machine.

Huh. This isn't good.

I was poking around the wsl2 vulns and searching for any known ones about wsl1 (which I still use) and saw this was just posted today.

I can't repro now but I have seen similar things happen in the past with running programs and such.