CVE-2026-42910: Windows Hotpatch Monitoring Service Elevation of Privilege Vulnerability

Synopsis

An out-of-bounds write vulnerability affects the Windows Hotpatch Monitoring Service on Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025. The flaw is exploitable locally by an attacker who already holds a low-privilege account on the target system, with no network exposure and no user interaction required. Successful exploitation gives the attacker full control over the affected system, including the ability to read, modify, or destroy data and disrupt running services. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or specific memory layout requirements to satisfy.

Blast Radius

• Reads sensitive data accessible to the SYSTEM account, including credentials, configuration secrets, and application data stored on the host.
• Modifies or overwrites files, registry keys, and process memory beyond what the attacker's original low-privilege account is permitted to touch.
• Crashes or terminates services running on the affected host, causing service disruption for workloads dependent on that system.
• Installs persistent mechanisms or injects code into privileged processes, enabling continued access beyond the initial exploit.