CVE-2026-42980: Windows Kernel Local Privilege Escalation via WMI Integer Underflow

Vulnerability ID: CVE-2026-42980
CVSS Score: 7.8
Published: 2026-06-09

An unsigned 32-bit integer underflow vulnerability in the Windows Management Instrumentation (WMI) serialization subsystem of ntoskrnl.exe allows local authenticated users with low privileges to corrupt adjacent kernel pool allocations, execute arbitrary kernel-mode read and write operations, and perform a Token Swap attack to escalate their privileges to NT AUTHORITY\SYSTEM.

TL;DR

A 32-bit integer underflow within the Windows kernel WMI subsystem allows a local low-privilege attacker to cause a heap-based buffer overflow, corrupt adjacent Named Pipe structures, and achieve local privilege escalation to SYSTEM.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-191
• Attack Vector: Local
• CVSS Score: 7.8
• EPSS Score: 0.05659
• Impact: Complete privilege escalation to SYSTEM
• Exploit Status: Public Proof of Concept (PoC) available
• KEV Status: Not listed

Affected Systems

• Windows 10
• Windows 11
• Windows Server 2022
• Windows Server 2025

Mitigation Strategies

• Apply June 2026 cumulative security updates
• Restrict non-administrative user access to the WMI device node
• Deploy host-based endpoint detection rules for Named Pipe spraying

Remediation Steps:

1. Download the latest cumulative security update for your Windows operating system version.
2. Apply the patch using Windows Update or Windows Server Update Services (WSUS).
3. Reboot the host to ensure the updated ntoskrnl.exe is loaded into memory.

Read the full report for CVE-2026-42980 on our website for more details including interactive diagrams and full exploit analysis.