WinBoat 0.9.1 Ships as a Security-First Patch, Points to 1.0 With GPU Acceleration
WinBoat, the open-source project that lets Linux users run Windows apps with native desktop integration, has released version 0.9.1. It is the final update in the 0.9 series and focuses almost entirely on security hardening. The team also confirmed that version 1.0 is already in active preparation.
WinBoat has quietly become one of Linux's more practical workarounds for Windows-only software. It packs QEMU/KVM into a Docker or Podman container, serves the guest OS to the host via FreeRDP, and composites individual Windows programs into native Linux windows. At roughly 22,500 GitHub stars, it has attracted plenty of attention from users who refuse to abandon specific Windows tools but want to stay on Linux.
The Security Patch
Published Tuesday night, the v0.9.1 patch rolls in four security fixes, bumps Electron to version 44, and backports a handful of stability improvements from earlier development branches. The most serious of the patched flaws was a PowerShell command injection vulnerability in the get-icon endpoint. An attacker could craft specific parameters to execute arbitrary PS1 commands inside the guest VM.
The fix landed within four hours of being reported by a GitHub researcher, according to the team.
The patch also closes a UNC path traversal issue in the icon lookup routine, caps the HTTP header read timeout to prevent Slowloris-style denial of service attacks, and redacts previously logged Docker Compose and FreeRDP credentials. The password leak was a backported fix from earlier alpha cycles.
Running an untrusted Windows virtual machine inside your home directory is not exactly low-risk by default. WinBoat bridges the host and guest through HTTP, which is why the patched vulnerabilities matter more than usual. Binding internal ports to 127.0.0.1 by default helps, but the get-icon endpoint and remote path handling proved that the attack surface is real. The fact that it was responsibly disclosed and patched in hours is a solid example of how open-source security actually works in practice.
What Comes Next
If you have been waiting for a major feature jump, the v0.9.1 notes drop a clear breadcrumb. The team explicitly says GPU acceleration is coming in version 1.0. Right now, WinBoat relies on CPU-only QEMU pass-through. PCI passthrough or virtio-GPU integration would meaningfully change how the app handles gaming, video editing, and CAD workloads. It is arguably the last real usability gap for the platform.
That said, GPU acceleration in containerized QEMU is notoriously finicky. virtio-GPU tends to play nicely with desktop applications, but passthrough solutions usually require host kernel tweaks that push against the exact portability WinBoat is known for. Keep in mind that the project still has about 78 commits ahead on the main branch before 1.0 lands. The timeline is not set, but the architecture is clearly moving in that direction.
Build Artifacts and Requirements
You can grab the release as an AppImage, .deb, .rpm, NixOS flake, or unpacked binary for both x64 and aarch64. You will still need at least 4 GB of RAM, two CPU threads, 32 GB of free disk space, and KVM enabled in your BIOS. If you are currently running the alpha on main, expect the next several months to focus on stabilization and GPU pipeline integration.
Head here to download the v0.9.1 release. WinBoat sits at a pretty good inflection point. The 0.9 series has aged well, and the security posture is now locked down. Version 1.0 is just waiting for that GPU pipeline to actually stabilize.
