Public PoC Released for CVE-2026-42980 Windows Privilege Escalation Flaw

TL;DR

A public proof-of-concept now targets CVE-2026-42980, a Windows privilege escalation flaw in the NT kernel. The bug lets a local, low-privileged user reach SYSTEM. Microsoft patched it in the June 2026 Patch Tuesday and rated exploitation “more likely.”

Why it matters

Kernel elevation bugs turn a foothold into full control. This one needs only local, authenticated access. No user interaction is required beyond logging in. With SYSTEM rights, an attacker can disable defenses and run any code. Attackers often pair such bugs with a browser or phishing foothold. That combination hands them the whole machine. The release of a working public proof-of-concept exploit raises the risk sharply. Both the vulnerability details and the exploit chain are now fully public.

How the attack works

The flaw is an integer underflow in the kernel’s WMI serialization code. Two WMI query paths track remaining output space in a 32-bit counter. The vulnerable build subtracts a provider-reported size without checking bounds. If that size is too large, the unsigned counter wraps to a huge value. The kernel then believes plenty of room remains. As a result, it writes past the end of a kernel buffer. The proof-of-concept turns that out-of-bounds write into an arbitrary read, then swaps in the SYSTEM token. We are not publishing exploit code or trigger details.

Affected versions

The bug affects supported Windows client and server releases. Microsoft assigned CVE-2026-42980 a CVSS score of 7.8. On Windows 11 24H2, the fixed kernel is build 10.0.26100.1992 or later. So far, no vendor has confirmed exploitation in the wild. Still, Microsoft’s “more likely” rating means defenders should treat this as urgent.

Patch and mitigation

Patch now to close this Windows privilege escalation flaw. Apply the June 2026 updates across all Windows hosts. Then check ntoskrnl.exe versions to confirm the fix landed. Review the Microsoft advisory for exact build numbers. Also hunt logs for unexpected privilege escalations tied to this CVE.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.