Windows Performance Monitor CVE-2026-42981

Exploitation requires network reachability to a Windows host exposing the Performance Monitor remote interface (typically via RPC over ports 135/445 and dynamic RPC ports) and no authentication to the target (PR:N), with no user interaction needed. Limiting factors per CVSS AC:H include the need to satisfy race conditions, heap or address-space layout state, or specific protocol sequencing to reliably trigger the integer underflow and convert memory corruption into code execution - meaning opportunistic mass exploitation is unlikely, consistent with SSVC Automatable=no. In practice, hosts that do not expose remote performance counter services on the network (e.g., workstations behind host firewalls blocking RPC) are not reachably exploitable, narrowing the realistic attack surface to servers and management hosts permitting remote performance/management traffic.

The CVSS 3.1 base score of 8.1 reflects network reach (AV:N), no privileges required (PR:N), no user interaction (UI:N), and full CIA impact (C:H/I:H/A:H), but is tempered by high attack complexity (AC:H), which indicates the attacker must overcome conditions beyond their control such as race windows, memory layout, or specific protocol state to achieve reliable exploitation. CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no,' which aligns with no public exploit identified at time of analysis - meaning real-world risk today is materially lower than the 8.1 score suggests, though Technical Impact is rated 'total.' EPSS data was not provided in the input, so the empirical exploitation probability cannot be quantified. The combination of high complexity, absence of observed exploitation, and a vendor-released patch suggests this should be prioritized for routine monthly patching rather than emergency remediation, though internet-exposed Windows hosts running services that interface with PerfMon should be patched promptly given the unauthenticated network vector.

An attacker on an adjacent network segment, or reaching an internet-exposed Windows host that accepts remote performance monitoring traffic, sends a specially crafted request with a malformed length or size field that triggers the integer underflow in PerfMon's parsing routine. The wrap-around produces an oversized buffer calculation that the attacker uses to corrupt adjacent memory and redirect execution, ultimately running code in the security context of the vulnerable service. High attack complexity means the attacker likely needs multiple attempts and detailed knowledge of target memory layout, but no public exploit identified at time of analysis.