CVE-2026-42977: Windows Push Notifications Elevation of Privilege Vulnerability

Synopsis

A race condition in the Windows Push Notifications component allows a locally authenticated attacker to escalate privileges on affected Windows 10 and Windows 11 systems. The vulnerability requires only a low-privilege account and no interaction from other users, but exploiting it depends on winning a timing window in shared-resource handling, which adds some environmental complexity. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the system, with scope extending beyond the immediate process boundary. Patched-image rebuilds at the fixed versions are available on HarborGuard for environments running an affected Windows base image.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  A low-privilege local account is sufficient; no administrative or elevated credentials are needed before exploitation.

• Victim interactionNot required

  The exploit runs entirely under the attacker's control with no action required from any other user.

• Attack complexityDetail

  Exploitation depends on winning a race condition over a shared resource, meaning timing and environmental factors affect reliability.

Blast Radius

• A successful attacker gains elevated system-level privileges, breaking out of the original process boundary and affecting other components on the host.
• Confidentiality is fully compromised: the attacker can read any data accessible on the system, including credentials, session tokens, and stored files.
• Integrity is fully compromised: the attacker can write to or modify any resource on the system, including security-sensitive configuration and binaries.
• Availability is fully compromised: the attacker can crash, disable, or otherwise disrupt any service or process running on the affected host.