CVE-2026-42916: NT OS Kernel Elevation of Privilege Vulnerability

Synopsis

An integer underflow (wrap-around) vulnerability in the Windows NT OS Kernel allows a locally authenticated attacker to elevate their privileges on the affected host. The attacker must already have a low-privilege account and local access; no network path or user interaction is involved. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the system, effectively granting kernel-level privileges. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or elevated credentials to trigger the vulnerability.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker can execute the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads protected kernel memory, local credential stores, and sensitive process data belonging to other users or the system.
• Modifies kernel data structures, system configurations, and files that are otherwise restricted to privileged processes.
• Terminates or destabilizes kernel-level processes, potentially crashing the host or disrupting all workloads running on it.
• Attains full kernel-level control over the affected Windows host, bypassing all user-space security boundaries.