CVE-2026-42991: Windows Push Notifications Elevation of Privilege Vulnerability

Synopsis

A race condition in the Windows Push Notifications component allows a locally authenticated attacker to elevate privileges on affected Windows 10 and Windows 11 systems. The attacker must already hold a low-privilege account and exploit a timing window in shared resource access to gain higher system privileges. Successful exploitation gives the attacker full control over the host, including confidentiality, integrity, and availability of all data and processes. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the race condition entirely from their own process.

• Attack complexityDetail

  Exploitation depends on winning a race condition in shared resource access, meaning the attacker must time execution correctly and success is not guaranteed on every attempt.

Blast Radius

• A successful exploit grants the attacker elevated privileges, allowing them to read any file or credential on the host regardless of access controls.
• The attacker can write or modify system files, registry keys, and persisted application data.
• The attacker can terminate processes, disable services, or crash the operating system, causing a full service outage.
• With SYSTEM-level access the attacker can install persistent backdoors or pivot laterally to other hosts on the network.