CVE-2026-42978: Windows Push Notifications Elevation of Privilege Vulnerability

Synopsis

A race condition in the Windows Push Notifications component allows a locally authenticated attacker to elevate privileges on affected Windows 10 and Windows 11 systems. The attacker must already hold a low-privilege account and exploit a timing window in shared-resource synchronization to gain higher-level access. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the host. Patched-image rebuilds at the fixed Windows versions are available on HarborGuard for environments running affected builds.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or elevated credentials to initiate the exploit.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker operates entirely on their own.

• Attack complexityDetail

  Exploitation depends on winning a race condition in shared-resource access, meaning timing and environmental factors affect reliability and the exploit is not unconditionally reproducible.

Blast Radius

• A successful attacker gains full read access to protected files, credentials, secrets, and other data on the host.
• The attacker can write to or modify any file or system configuration, including security-sensitive settings and persistent data.
• The attacker can crash, disable, or otherwise disrupt any service or process on the host.
• Because the scope is changed (S:C), the attacker's elevated access can extend beyond the immediate process boundary to affect other components or services on the same host.