CVE-2026-42980 is a local privilege escalation vulnerability in the Windows NT OS Kernel caused by an unsigned 32-bit integer underflow (wraparound) in two related WMI (Windows Management Instrumentation) serialization routines inside ntoskrnl.exe: `nt!WmipQueryAllDataMultiple` (reached via IOCTL 0x22812C) and `nt!WmipQuerySingleMultiple` (reached via IOCTL 0x228130). Both functions maintain a 32-bit remaining-output-buffer counter and perform an unchecked unsigned subtraction, `OutputBufferLength -= AlignedSize`, of the provider-reported aligned record size. A capacity gate uses an estimated size formula, `(DataSize + 73) & ~7`, to admit an item, while the later subtraction uses the actual aligned size, `(ReturnedDataSize + 7) & ~7` — the mismatch between these two roundings lets an attacker craft a WNODE record whose aligned size exceeds the remaining counter, causing the subtraction to wrap to a very large unsigned value (e.g. a `0x94`-byte remaining capacity minus a `0x98`-byte record wraps to `0xFFFFFFFC`). The kernel then treats this wrapped value as legitimate remaining capacity and permits a second WNODE item to be serialized far out of bounds, corrupting adjacent non-paged pool allocations.

The public PoC (`CVE-2026-42980-POC`, author G4sp4rCS) documents a full, reliable exploitation chain reachable by any authenticated low-privileged local user via `\Device\WMIDataDevice`, requiring no user interaction: (1) build/OS-version detection to select correct offsets; (2) dynamic resolution of `NtFsControlFile`, `NtDeviceIoControlFile`, and the advapi32.dll WMI wrapper APIs `WmiOpenBlock`/`WmiQueryAllDataW`, paired with a runtime scan of a bundled WMI GUID dataset (candidate provider classes include `MSNdis_CoTransmitPduErrors`, `WmiMonitorConnectionParams`, and `MSPower_DeviceEnable`) to locate a WMI provider whose capacity-gate/actual-size mismatch is exploitable on the current build/VM/hardware profile; (3) non-paged pool grooming by spraying roughly 4,096 named pipes (pool tag `NpFr`) sized to match the WMI `SystemBuffer` allocation bucket (`METHOD_BUFFERED` IOCTL with padded input length `0xff0`), then freeing one pipe to create a targeted hole; (4) triggering the vulnerable WMI query so the kernel allocates `SystemBuffer` into the freed hole adjacent to a live `NP_DATA_QUEUE_ENTRY` (named-pipe queue entry) structure; (5) the underflow-driven out-of-bounds write corrupts the `DataSize` field of that queue entry; (6) calling `PeekNamedPipe` on the corrupted pipe over-reads adjacent kernel pool metadata at a stable offset (`0xfd0`), leaking kernel pointers and resolving the exploiting process's own base addresses; (7) a second underflow trigger reshapes the corrupted queue entry into an IRP-backed object, yielding an arbitrary kernel-memory read/write primitive; (8) using that primitive, the exploit walks the kernel's `ActiveProcessLinks` list from the current `EPROCESS` to PID 4 (the `System` process), reads its `Token` field, and overwrites the calling process's own `EPROCESS.Token` with it (Access Token Manipulation / Token Impersonation-Theft); (9) the exploit repairs the corrupted named-pipe structure to restore kernel stability and avoid a bugcheck/crash-triggered detection; (10) it then spawns `cmd.exe`, which inherits the just-stolen NT AUTHORITY\SYSTEM token, giving the attacker a fully privileged interactive shell.

Microsoft addressed the flaw in the June 9, 2026 Patch Tuesday cycle (Windows 11 24H2/25H2 via KB5094126, Windows 11 23H2 via KB5093998, and corresponding Windows 10 and Windows Server cumulative updates) by replacing the unchecked subtraction with saturating arithmetic gated behind an internal feature flag (`Feature_1045423416`): if the aligned size is less than the remaining length the subtraction proceeds normally, otherwise the remaining length saturates to zero instead of wrapping, which breaks the exploitation chain at the arithmetic layer by preventing the second WNODE from landing in the groomed adjacent object. At the time of patch release the vulnerability was not known to be exploited in the wild and carried no public exploit; NVD's CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), impact subscore 5.9, exploitability subscore 1.8, with weaknesses classified as CWE-191 (Integer Underflow) and CWE-122 (Heap-based Buffer Overflow); no CVSS v4.0 score had been published as of the last NVD update (2026-07-23). FIRST.org's EPSS model scores CVE-2026-42980 at 0.0695 (6.95% probability of exploitation in the next 30 days), placing it in the 93.43rd percentile of all scored CVEs — a comparatively high percentile for a vulnerability with no confirmed in-the-wild activity, driven by the public, fully weaponized PoC. The June 2026 Patch Tuesday cycle also addressed several other Windows elevation-of-privilege and remote-code-execution issues in adjacent components — a use-after-free RCE in the Windows Kernel (CVE-2026-45657), and use-after-free EoP flaws in DWM Core Library (CVE-2026-42905), the Microsoft Graphics component (CVE-2026-42986), and Winlogon (CVE-2026-42989) — released the same day but tracked as separate, technically unrelated vulnerabilities.

On July 7, 2026, security researcher G4sp4rCS published the fully working proof-of-concept to the public GitHub repository `G4sp4rCS/CVE-2026-42980-POC`, including C source (`src/cve_2026_42980_lpe.c`, `src/helpers.c`, `src/wmi_guids.h`), a `Makefile` and PowerShell build script (`build.ps1`), a proof screenshot (`assets/photo-poc-system.jpg`), and English/Spanish technical writeups (`writeup-en.md`, `writeup-es.md`), explicitly framed for educational, defensive-research, and authorized-testing use only, to be run exclusively in isolated lab systems. Cyber Security News covered the public release on July 22, 2026, and vulnerability-intelligence platforms (cvereports.com, cvemon/intruder.io) published independent technical breakdowns of the exploitation chain around the same date. As of this writing CVE-2026-42980 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no confirmed evidence of active in-the-wild exploitation — its elevated 93.43rd-percentile EPSS score reflects the public PoC's reliability and reach, not observed campaign activity.

The vulnerability affects a broad range of currently supported Windows client and server releases (Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1 across x86/x64/ARM64, and Windows Server 2012/2012 R2/2016/2019/2022/2025), making it broadly relevant to enterprise and consumer estates that have not applied the June 2026 or later cumulative security update.