Loading vulnerability…
CVE-2026-42980 is an elevation-of-privilege vulnerability in the Windows NT OS Kernel. The flaw is caused by an integer underflow that wraps a size or remaining-length value, causing the kernel to incorrectly treat available buffer space as much larger than it actually is. Available reporting indicates this can lead to a heap-based out-of-bounds write in kernel memory, with some analyses specifically describing the vulnerable logic as occurring in WMI serialization code where a provider-reported size is subtracted from a 32-bit remaining-space counter without proper bounds checking. The resulting kernel heap corruption can be leveraged by a locally authenticated low-privileged attacker to obtain arbitrary kernel memory manipulation and ultimately escalate privileges to NT AUTHORITY\SYSTEM.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a public Windows local privilege escalation PoC for CVE-2026-42980, a WMI kernel integer-underflow vulnerability. It is not part of a larger exploit framework. The repository contains one main exploit source file (src/cve_2026_42980_lpe.c), one helper source file (src/helpers.c), a large auto-generated WMI GUID list (src/wmi_guids.h), build scripts (build.ps1 and Makefile), and English/Spanish write-ups documenting the bug and exploitation chain. The exploit targets the Windows kernel WMI subsystem, specifically the nt!WmipQuerySingleMultiple path reachable through \Device\WMIDataDevice using IOCTL 0x00228130. The write-up also documents a sibling vulnerable path, nt!WmipQueryAllDataMultiple via IOCTL 0x22812C, but the PoC uses the single-multiple query path. The core bug is an unchecked subtraction on a 32-bit remaining-output counter, allowing underflow and subsequent out-of-bounds kernel writes past the WMI SystemBuffer. Operationally, the exploit performs local pool grooming with named pipes (\\.\pipe\exploit_test), triggers the WMI bug to corrupt adjacent NPFS pipe queue structures, converts that corruption into kernel memory disclosure and arbitrary read/write primitives, walks EPROCESS structures to find PID 4, reads the SYSTEM token, writes that token into the current process, repairs the corrupted pipe object, and finally launches a SYSTEM shell. The helper code confirms build-specific kernel offsets for several Windows build ranges and implements the arbitrary read primitive using PeekNamedPipe against a corrupted fake IRP/pipe structure. The exploit includes a hardcoded post-exploitation payload of spawning cmd.exe /k whoami as SYSTEM, so it is more than a pure crash PoC but not a flexible framework-integrated weaponized exploit. Build support is provided for MSVC x64 on Windows via PowerShell and nmake. Overall, this is a real, code-backed, local kernel LPE exploit with a complete end-to-end chain from trigger to SYSTEM shell.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windows NT OS Kernel elevation of privilege vulnerability caused by an integer underflow in WMI serialization code that can let a local authenticated low-privileged user escalate to SYSTEM.
A Windows NT OS Kernel local elevation-of-privilege vulnerability caused by an integer underflow that can lead to heap-based buffer overflow and kernel memory corruption, allowing escalation to SYSTEM.
NT OS Kernel elevation-of-privilege vulnerability assessed as more likely to be exploited within 30 days.
An elevation of privilege vulnerability in NT OS Kernel.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.