EUVD-2026-35739
GHSA-j8g4-4862-cvp2
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to higher privileges by exploiting a race condition (CWE-362) in concurrent access to a shared resource. Successful exploitation results in high impact to confidentiality, integrity, and availability with scope change, but no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local interactive or authenticated session access to the target Windows host with at least low-privilege user rights (PR:L) and the ability to execute arbitrary code that interacts with the Windows Push Notifications service; no user interaction from another user is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 reflects local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), scope change (S:C), and high impact across CIA - meaning a logged-in standard user could escape into another security domain (likely SYSTEM). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privileged user - for example, a standard domain user on a shared workstation or a low-privilege service account on a multi-tenant terminal server - runs a crafted binary that repeatedly triggers operations against the Windows Push Notification subsystem while a second thread races to swap or modify the shared resource between validation and use. After winning the race, the attacker pivots from limited user to SYSTEM, enabling credential theft from LSASS, installation of persistence, and lateral movement. … |
| Remediation | Apply the patch available per Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42977 by deploying the relevant cumulative or security update for each affected Windows version through Windows Update, WSUS, or your enterprise patch management platform. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Windows systems in your environment and assess their current patch status against the latest Microsoft security updates. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today