CVE-2026-42980: Windows Kernel Local Privilege Escalation via WMI Integer Underflow
Vulnerability ID: CVE-2026-42980
CVSS Score: 7.8
Published: 2026-06-09
An unsigned 32-bit integer underflow vulnerability in the Windows Management Instrumentation (WMI) serialization subsystem of ntoskrnl.exe allows local authenticated users with low privileges to corrupt adjacent kernel pool allocations, execute arbitrary kernel-mode read and write operations, and perform a Token Swap attack to escalate their privileges to NT AUTHORITY\SYSTEM.
TL;DR
A 32-bit integer underflow within the Windows kernel WMI subsystem allows a local low-privilege attacker to cause a heap-based buffer overflow, corrupt adjacent Named Pipe structures, and achieve local privilege escalation to SYSTEM.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-191
- Attack Vector: Local
- CVSS Score: 7.8
- EPSS Score: 0.05659
- Impact: Complete privilege escalation to SYSTEM
- Exploit Status: Public Proof of Concept (PoC) available
- KEV Status: Not listed
Affected Systems
- Windows 10
- Windows 11
- Windows Server 2022
- Windows Server 2025
Mitigation Strategies
- Apply June 2026 cumulative security updates
- Restrict non-administrative user access to the WMI device node
- Deploy host-based endpoint detection rules for Named Pipe spraying
Remediation Steps:
- Download the latest cumulative security update for your Windows operating system version.
- Apply the patch using Windows Update or Windows Server Update Services (WSUS).
- Reboot the host to ensure the updated ntoskrnl.exe is loaded into memory.
Read the full report for CVE-2026-42980 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)