CVE-2026-42980: Windows NT OS Kernel Local Privilege Escalation via WMI Integer Underflow (Public PoC) — Threadlinqs Intelligence
As of 2026-07-26, CVE-2026-42980: Windows NT OS Kernel Local Privilege Escalation via WMI Integer Underflow (Public PoC) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-1707 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-42980 is a CVSS 7.8 integer-underflow vulnerability in the WMI serialization path of the Windows NT OS Kernel (ntoskrnl.exe) that lets a locally authenticated, low-privileged attacker corrupt
CVE-2026-42980 is a local privilege escalation vulnerability in the Windows NT OS Kernel caused by an unsigned 32-bit integer underflow (wraparound) in two related WMI (Windows Management Instrumentation) serialization routines inside ntoskrnl.exe: `nt!WmipQueryAllDataMultiple` (reached via IOCTL 0x22812C) and `nt!WmipQuerySingleMultiple` (reached via IOCTL 0x228130). Both functions maintain a 32-bit remaining-output-buffer counter and perform an unchecked unsigned subtraction, `OutputBufferLength -= AlignedSize`, of the provider-reported aligned record size. A capacity gate uses an estimated size formula, `(DataSize + 73) & ~7`, to admit an item, while the later subtraction uses the actual aligned size, `(ReturnedDataSize + 7) & ~7` — the mismatch between these two roundings lets an attacker craft a WNODE record whose aligned size exceeds the remaining counter, causing the subtraction to wrap to a very large unsigned value (e.g. a `0x94`-byte remaining capacity minus a `0x98`-byte record wraps to `0xFFFFFFFC`). The kernel then treats this wrapped value as legitimate remaining capacity and permits a second WNODE item to be serialized far out of bounds, corrupting adjacent non-paged pool allocations.
The public PoC (`CVE-2026-42980-POC`, author G4sp4rCS) documents a full, reliable exploitation chain reachable by any authenticated low-privileged local user via `\Device\WMIDataDevice`, requiring no user interaction: (1) build/OS-version detection to select correct offsets; (2) dynamic resolution of `NtFsControlFile`, `NtDeviceIoControlFile`, and the advapi32.dll WMI wrapper APIs `WmiOpenBlock`/`WmiQueryAllDataW`, paired with a runtime scan of a bundled WMI GUID dataset (candidate provider classes include `MSNdis_CoTransmitPduErrors`, `WmiMonitorConnectionParams`, and `MSPower_DeviceEnable`) to locate a WMI provider whose capacity-gate/actual-size mismatch is exploitable on the current build/VM/hardware profile; (3) non-paged pool grooming by spraying roughly 4,096 named pipes (pool tag `NpFr`) sized to match the WMI `SystemBuffer` allocation bucket (`METHOD_BUFFERED` IOCTL with padded input length `0xff0`), then freeing one pipe to create a targeted hole; (4) triggering the vulnerable WMI query so the kernel allocates `SystemBuffer` into the freed hole adjacent to a live `NP_DATA_QUEUE_ENTRY` (named-pipe queue entry) structure; (5) the underflow-driven out-of-bounds write corrupts the `DataSize` field of that queue entry; (6) calling `PeekNamedPipe` on the corrupted pipe over-reads adjacent kernel pool metadata at a stable offset (`0xfd0`), leaking kernel pointers and resolving the exploiting process's own base addresses; (7) a second underflow trigger reshapes the corrupted queue entry into an IRP-backed object, yielding an arbitrary kernel-memory read/write primitive; (8) using that primitive, the exploit walks the kernel's `ActiveProcessLinks` list from the current `EPROCESS` to PID 4 (the `System` process), reads its `Token` field, and overwrites the calling process's own `EPROCESS.Token` with it (Access Token Manipulation / Token Impersonation-Theft); (9) the exploit repairs the corrupted named-pipe structure to restore kernel stability and avoid a bugcheck/crash-triggered detection; (10) it then spawns `cmd.exe`, which inherits the just-stolen NT AUTHORITY\SYSTEM token, giving the attacker a fully privileged interactive shell.
Microsoft addressed the flaw in the June 9, 2026 Patch Tuesday cycle (Windows 11 24H2/25H2 via KB5094126, Windows 11 23H2 via KB5093998, and corresponding Windows 10 and Windows Server cumulative updates) by replacing the unchecked subtraction with saturating arithmetic gated behind an internal feature flag (`Feature_1045423416`): if the aligned size is less than the remaining length the subtraction proceeds normally, otherwise the remaining length saturates to zero instead of wrapping, which breaks the exploitation chain at the arithmetic layer by preventing the second WNODE from landing in the gro
Weaknesses (CWE)
CWE-191, CWE-122
Target sectors: government administration, finance, health, technology, manufacturing, education, criticalinfrastructure, retail
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-42980, T1078.003, T1059.001, T1059.003, T1106, T1047, T1068, T1134.001, T1134, T1027.007, T1211