CVE-2026-42836: Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability

Synopsis

A race condition (concurrent execution against a shared resource without proper synchronization) in the Windows Function Discovery Service (fdwsd.dll) allows a local attacker to escalate their privileges on affected Windows 10 and Windows 11 systems. The attacker must already hold a low-privilege account and execute code locally; no network exposure or victim interaction is required. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at the fix versions listed above are available on HarborGuard for environments running an affected Windows base image.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or elevated credentials to initiate the exploit.

• Victim interactionNot required

  No user interaction is needed; the attacker executes the exploit entirely on their own without involving another account or session.

• Attack complexityDetail

  Attack complexity is High, meaning the exploit depends on winning a race condition against a shared resource, requiring precise timing or repeated attempts rather than a single reliable trigger.

Blast Radius

• A successful attacker reads any file or credential material on the system, including stored secrets, configuration data, and other users' session tokens.
• The attacker writes to or modifies any file or registry entry on the system, including security-relevant configurations and audit logs.
• The attacker crashes or terminates system services, causing denial of service to any process running on the host.
• Privilege escalation to SYSTEM or equivalent gives the attacker full persistent control over the compromised host.