CVE-2026-42974: Windows Performance Monitor Remote Code Execution Vulnerability

Synopsis

An integer underflow vulnerability in Windows Performance Monitor allows a remote, unauthenticated attacker to execute arbitrary code on affected systems over the network. The flaw is triggered by sending malformed input that causes an arithmetic wraparound, corrupting memory in a way that redirects execution. Successful exploitation gives the attacker full code execution on the host, with potential for data theft, tampering, and service disruption. Patched-image rebuilds at the fixed versions are available on HarborGuard for environments running affected Windows Server base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Windows Performance Monitor service over the network; the service must be exposed to the attacker's origin.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is reachable by any unauthenticated network caller.

• Victim interactionNot required

  No user action is required; the attacker triggers the vulnerability without any participation from a logged-in user.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must meet specific environmental conditions or timing constraints beyond simple delivery of a malformed request.

Blast Radius

• A successful attacker achieves arbitrary code execution in the context of the Windows Performance Monitor service process.
• Confidentiality impact is high: the attacker can read process memory, credentials, or any data accessible to the service account.
• Integrity impact is high: the attacker can write or modify files, registry keys, and in-memory data on the host.
• Availability impact is high: the attacker can crash the service or destabilize the host, interrupting monitoring and dependent workloads.