Windows Push Notifications CVE-2026-42979

The attacker must already hold local, interactive or interactive-equivalent execution on the target Windows host as a low-privileged authenticated user (PR:L, AV:L, UI:N), and must reliably win a timing race against the Windows Push Notifications service (AC:H), which typically requires multiple attempts and may be sensitive to CPU load, core count, and scheduler behavior. Exploitation is limited by the need for prior local code execution (no remote vector), the high attack complexity of the race window, and the requirement that the Push Notifications service be running and reachable to the attacker's session - the default on supported Windows builds. Headless servers that have disabled the user-mode notification stack, or systems where untrusted local code execution is prevented by WDAC/AppLocker, materially reduce realistic exposure.

The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) signals a meaningful but constrained risk: an attacker must already have local code execution with low privileges and must reliably win a race (AC:H), but successful exploitation yields full system compromise across an authority boundary. There is no EPSS score, KEV listing, or public POC referenced, suggesting this is currently a vendor-disclosed bug rather than something seen in the wild - typical for an MSRC-coordinated Patch Tuesday item. The realistic priority is moderate-to-high for endpoint fleets where local code execution is plausible (multi-user hosts, RDP/Citrix servers, post-phishing chains) because race conditions in notification brokers are historically reachable with repeated triggering even when AC:H suggests difficulty; on locked-down single-user devices the practical risk is lower. No conflicting data was observed; the absence of EPSS and KEV reflects recency rather than contradiction.

A standard user on a shared Windows host - for example, an RDP jump server or a workstation already compromised by a phishing payload running as the logged-in user - launches a small tool that repeatedly triggers the vulnerable Push Notifications code path while concurrently manipulating the shared resource. After enough iterations the race is won, allowing the attacker's process to influence privileged operations and elevate to SYSTEM. No public POC was identified at time of analysis.