CVE-2026-42984: Windows Kernel Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Kernel allows a locally authenticated attacker to escalate privileges on affected Windows 10 and Windows 11 systems. Exploitation requires an existing low-privilege account on the target machine and does not require network access or any user interaction, but the exploit is timing-dependent and not trivially reliable. Successful exploitation grants the attacker full control over the affected host, including reading, modifying, or destroying any data on the system. Patched-image rebuilds at the fixed kernel versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker must be able to execute code on the machine under an authenticated user context.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the vulnerability entirely through their own process without involving another user.

• Attack complexityDetail

  Exploitation is timing-dependent, likely involving a race condition to trigger the use-after-free window, making the exploit less than fully reliable without tuning.

Blast Radius

• A successful attacker gains kernel-level privileges, allowing them to read any file, credential store, or memory region on the host regardless of access controls.
• The attacker can modify kernel data structures, overwrite system files, or install a persistent rootkit that survives reboots.
• The attacker can crash or halt the operating system at will, taking down all workloads running on the affected host.
• Any secrets, tokens, or certificates accessible to the operating system (including those held by containerized workloads on the host) are exposed to the attacker.