EUVD-2026-35598
GHSA-jh49-99q5-mwf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-priv local execution
-
DeliveryIdentify vulnerable kernel syscall path
-
ExploitTrigger integer underflow with crafted input
-
InstallCorrupt kernel heap pool object
-
C2Overwrite token or callback pointer
-
ExecuteElevate process to SYSTEM
-
ImpactDisable defenses and persist
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess authenticated local code execution as a low-privileged user on the target Windows system (CVSS PR:L, AV:L), meaning this is not directly exploitable from the network or by anonymous users. No user interaction is required once the attacker has local execution (UI:N), and no special non-default Windows configuration, optional feature, or specific hardware is identified in the description as a prerequisite - the vulnerable code path is in the core NT kernel and presumed reachable on default installations of affected Windows versions. Practical limits on exploitation are the local-access requirement and the need for the attacker to craft a working kernel heap-grooming primitive, which raises exploit-development complexity above trivial userland bugs but is well within the capability of mid-tier offensive actors. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a local, low-complexity, low-privilege EoP with full CIA impact - a profile typical of kernel pool corruption flaws. No EPSS score, KEV listing, or SSVC decision data is provided in the input, so probabilistic exploitation likelihood cannot be quantitatively assessed. The bug is not remotely exploitable in isolation (AV:L), meaning real-world risk depends on the attacker already having code execution as a standard user - a condition routinely met after phishing, browser exploits, or commodity malware infection. Kernel EoP vulnerabilities of this exact class are historically high-value targets for ransomware affiliates and offensive tooling, so although no public exploit is identified at time of analysis, the latent risk over the patch lifecycle is meaningful and this should not be deprioritized merely because it is 'local-only'. |
| Exploit ScenarioDerived | An attacker first obtains low-privileged code execution on a Windows host through a phishing payload, malicious document, or stolen standard-user credentials. They then run a crafted user-mode program that issues syscalls or IOCTLs designed to trigger the integer underflow in the NT kernel, corrupting heap pool memory to overwrite a kernel object (commonly a token or callback pointer) and pivot to SYSTEM privileges. No public exploit is identified at time of analysis, but the bug class is well-understood and proof-of-concept development would be feasible for a skilled exploit writer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Local privilege escalation in the Windows NT OS Kernel allows an authenticated low-privileged attacker to elevate to SYSTEM by triggering an integer underflow condition. With a CVSS of 7.8 and no public exploit identified at time of analysis, this issue is primarily a post-compromise escalation vector commonly chained after initial access via phishing or commodity malware. Microsoft has released a patch through MSRC, and given Windows kernel EoP bugs are frequently weaponized by ransomware and APT actors historically, prompt patching is warranted despite the absence of confirmed in-the-wild exploitation.
RemediationAI
Apply the Microsoft-released security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42980 - patch available per vendor advisory, though the specific KB number and exact fixed kernel build are not enumerated in the input data and must be retrieved from MSRC for each affected Windows SKU. Prioritize patching multi-user systems, terminal servers, VDI hosts, and developer workstations where untrusted local code is most likely to execute. Until patching is complete, compensating controls include restricting local logon rights to trusted accounts via Group Policy (User Rights Assignment), enforcing application allowlisting through Windows Defender Application Control or AppLocker to prevent unsigned attacker binaries from running, and enabling Microsoft Defender for Endpoint with attack surface reduction rules to detect post-exploitation kernel-mode behavior - noting that AppLocker bypasses are well-known and these controls only raise the bar rather than eliminate the vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 34 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Windows NT OS Kernel - the core ring-0 component (ntoskrnl.exe) responsible for memory management, process scheduling, and system call handling. The root cause is CWE-122 (Heap-based Buffer Overflow), here triggered through an integer underflow/wraparound: an arithmetic operation on an unsigned value produces a value larger than expected, which is then used as a size or index for a heap allocation or copy, resulting in out-of-bounds writes within kernel pool memory. The 'Buffer Overflow, Heap Overflow' tags confirm the bug manifests as a heap corruption primitive in kernel space, which when exploited successfully grants attackers arbitrary kernel read/write and full SYSTEM privileges. Specific affected Windows builds are not enumerated in the available data and must be retrieved from MSRC.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Windows NT Kernel local privilege escalation (CVE-2026-42980) enables authenticated attackers to escalate to SYSTEM privileges, creating post-compromise risk across Windows infrastructure used by ransomware and advanced persistent threat actors. Organizations face elevated risk that initial access via phishing or commodity malware will be followed by privilege escalation and lateral movement to critical systems. Microsoft has released a patch; immediate deployment is critical to reduce the attack surface for ransomware groups and APT campaigns.
Apply vendor patch (MSRC release). Until fully deployed, implement network segmentation and EDR solutions to detect post-compromise privilege escalation attempts; restrict administrative account usage to essential systems only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Related Vulnerabilities in Windows NT OS Kernel Integer Underflow EoP
View all 2More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB