Public PoC for Windows Kernel Flaw CVE-2026-42980 Enables SYSTEM Privilege Escalation

A public proof-of-concept exploit has been released for CVE-2026-42980, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain NT AUTHORITY\SYSTEM access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds.

Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a CVSS 3.1 score of 7.8, and assessed exploitation as "more likely." While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.