EUVD-2026-35736
GHSA-j6cc-qpjj-g659
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows Performance Monitor (PerfMon) allows unauthenticated network-based attackers to execute arbitrary code by triggering an integer underflow condition. The flaw carries a CVSS 3.1 score of 8.1 driven by high impact across confidentiality, integrity, and availability, though high attack complexity (AC:H) tempers exploitability. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but Microsoft has released a patch via MSRC guidance.
Technical ContextAI
Windows Performance Monitor (PerfMon) is a built-in Windows management tool that collects, displays, and logs system performance counter data from local and remote machines, communicating across networks via RPC and related Windows performance counter APIs. The root cause is CWE-190 (Integer Overflow or Wraparound) - specifically an integer underflow where a subtraction or decrement operation produces a value below the representable minimum, wrapping to a large unsigned value. When that wrapped value is subsequently used as a size or offset in memory operations, it can corrupt heap metadata or adjacent buffers, enabling control of execution flow. The 'Authentication Bypass' tag combined with PR:N implies the vulnerable code path is reachable before normal authentication completes on the network-facing PerfMon component.
RemediationAI
Apply the patch available per Microsoft's vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42974 through the relevant monthly Windows security update for each affected Windows edition; the exact KB article numbers should be retrieved from the MSRC guide for the specific Windows build in use. As compensating controls until patching completes, block inbound TCP/445 and dynamic RPC endpoint mapper traffic (TCP/135 and the high-port range) from untrusted networks at the host or perimeter firewall to remove the network attack surface, with the trade-off that legitimate remote management and file-sharing workflows will break. Disabling or restricting the Performance Logs and Alerts service and the Remote Registry service on hosts that do not require remote performance counter collection further reduces the reachable code path, though this will prevent centralized monitoring tools from polling those hosts.
More in Windows 11 23h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. Rated critical severity (CVSS 9.8), thi
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today