CVE-2026-42981: Windows Performance Monitor Remote Code Execution Vulnerability

Synopsis

An integer underflow vulnerability in Windows Performance Monitor allows an unauthenticated remote attacker to execute arbitrary code on affected systems. The flaw is reachable over the network with no credentials required, though exploitation involves meaningful complexity due to race conditions or environmental factors. Successful exploitation gives an attacker full code execution on the target, enabling complete confidentiality, integrity, and availability impact. Patched-image rebuilds at the relevant fix versions are available on HarborGuard for environments running affected Windows Server versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Windows Performance Monitor service over the network; no local access or physical proximity is needed.

• AuthenticationNot required

  No credentials or account of any privilege level are required to attempt exploitation.

• Victim interactionNot required

  The attack is fully remote and does not require any action from a user on the target system.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for race conditions, specific memory layout, or other environmental factors that are not fully under their control.

Blast Radius

• A successful attacker executes arbitrary code in the context of the affected Windows service, gaining a foothold on the host.
• Confidentiality is fully compromised: the attacker can read any data accessible to the exploited process, including credentials, configuration files, and in-memory secrets.
• Integrity is fully compromised: the attacker can write, modify, or delete files and registry state on the host.
• Availability is fully compromised: the attacker can crash, hang, or otherwise disable the affected service and dependent workloads.