CVE-2026-42980: NT OS Kernel Elevation of Privilege Vulnerability

Synopsis

An integer underflow (wrap-around) vulnerability in the Windows NT OS Kernel allows a locally authenticated attacker to elevate privileges on affected Windows 10 and Windows 11 systems. The attacker must already have a low-privilege account on the target host; no network access or user interaction is required. Successful exploitation grants full control over the system, including the ability to read, modify, or destroy any data and crash the operating system. Patched-image rebuilds at the fixed kernel versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No action from another user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or specific memory layout dependencies required.

Blast Radius

• A successful attacker gains kernel-level privileges, allowing them to read any data on the system including credentials, secrets, and protected memory.
• The attacker can modify or overwrite any file, registry key, or system configuration on the host.
• The attacker can install persistent backdoors or tamper with security tooling running on the host.
• The attacker can crash the operating system or any running process, causing a full denial of service.