What is the CVSS score of CVE-2026-42979?

CVE-2026-42979 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Windows Push Notifications are affected by CVE-2026-42979?

Microsoft Windows Push Notifications service contains a local privilege escalation vulnerability (CVE-2026-42979) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-42979?

Within 24 hours: Conduct a complete inventory of Windows systems running Push Notifications service and document current patch levels. Within 7 days: Obtain and validate the vendor-released patch from the Microsoft Security Response Center advisory in non-production environments. Within 30 days: Deploy the patch to all production Windows systems identified in your inventory.

Windows Push Notifications CVE-2026-42979

EUVD-2026-35740 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-j5xm-8fgh-w49x

Information Disclosure Microsoft Race Condition Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2019 Windows Server 2022 Windows Server 2025

High

Disputed · 7.8 Vendor: microsoft

Temporal: 6.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:40 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an attacker with low-privileged local access can exploit to gain higher privileges. No public exploit identified at time of analysis, and the issue is not on CISA KEV, but the CVSS 7.8 rating reflects high impact across confidentiality, integrity, and availability once the race is won. A vendor patch is available via the Microsoft Security Response Center advisory.

Technical ContextAI

Windows Push Notifications (WNS/WpnService) is a Microsoft component that brokers toast and tile notifications between user-mode apps and a system-level service, and it routinely handles cross-process IPC and shared resource state. The CWE-362 classification points to concurrent execution against a shared resource without proper synchronization - typically a TOCTOU window where the privileged service reads or operates on state that an attacker-controlled lower-privileged process can mutate between check and use. The CVSS Scope:Changed (S:C) bit further indicates the flawed component (running as the attacker) can affect resources beyond its own security authority, consistent with a user-context process influencing a higher-privileged Windows service.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42979) corresponding to your Windows build - patch is available from the vendor, though an exact KB/build number was not provided in the input and must be taken directly from the MSRC update guide for your SKU. Until the update is deployed, prioritize patching multi-user systems (terminal servers, VDI hosts, shared workstations) where local low-privileged footholds are most likely. As a compensating control, reduce the population of users who can execute arbitrary code on endpoints via AppLocker or WDAC policies and tighten interactive-logon rights on servers; disabling the Windows Push Notifications User Service (WpnUserService) is not recommended as a workaround because it breaks toast notifications across UWP/MSIX apps and is not confirmed by the vendor to mitigate the race, so prefer patching over service disablement.