What is the CVSS score of CVE-2026-42978?

CVE-2026-42978 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Windows Push Notifications are affected by CVE-2026-42978?

A privilege escalation vulnerability in Microsoft Windows Push Notifications service allows authenticated low-privileged users to gain administrative control and compromise system security boundaries…. A patch is available.

How to fix or mitigate CVE-2026-42978?

Within 24 hours: Inventory all Windows systems with Push Notifications service enabled and identify business-critical assets. Within 7 days: Apply Microsoft's security patch for CVE-2026-42978 across all affected systems per vendor advisory. Within 30 days: Verify patch compliance across the entire Windows fleet, review authentication and privilege escalation logs for exploitation indicators, and confirm complete remediation.

Windows Push Notifications CVE-2026-42978

EUVD-2026-35738 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-mjxj-356g-98wq

Information Disclosure Microsoft Race Condition Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2019 Windows Server 2022 Windows Server 2025

High

Disputed · 7.8 Vendor: microsoft

Temporal: 6.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:39 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in concurrent handling of shared resources, allowing an authorized low-privileged attacker to win a timing window and elevate to higher privileges with scope change. The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H reflects local-only exploitation with high attack complexity due to the timing-dependent nature, but a successful attacker gains full confidentiality, integrity, and availability impact across a security boundary. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Windows Push Notifications subsystem (WPN / WpnService), which delivers toast and tile notifications to user sessions and brokers requests between user-mode apps and system components. The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), a classic race condition where two or more threads access a shared object - typically a handle, registry key, or memory region - without adequate locking, allowing an attacker to interleave operations between a check and a use (TOCTOU). Because the WPN service runs with elevated rights and exposes IPC interfaces to lower-privileged callers, winning the race lets an authorized user influence operations performed in a higher-privileged security context, which aligns with the Scope:Changed component of the CVSS vector.

RemediationAI

Apply the Microsoft-released security update for CVE-2026-42978 as listed in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42978 - patch available per vendor advisory, with exact KB numbers varying by Windows SKU and build. Until patches are deployed, reduce exposure by restricting interactive and remote-interactive logon rights on sensitive hosts so that only trusted accounts can reach the local attack surface (trade-off: may disrupt shared workstation, RDS, and VDI workflows), and consider stopping or disabling the WpnService / WpnUserService where notification functionality is not required (trade-off: breaks toast notifications, Action Center delivery, and some Store-app features). Monitor for repeated crashes or anomalous behavior of the Windows Push Notifications service, which can indicate race-condition exploitation attempts.