Public PoC Released for Windows NT OS Kernel Privilege Escalation Vulnerability

Public proof-of-concept (PoC) exploit code was released for CVE-2026-42980, a local privilege escalation vulnerability in the Windows NT OS Kernel. This vulnerability occurs due to an integer underflow in kernel-mode code.

CVE-2026-42980 is an elevation-of-privilege flaw in the Windows NT OS Kernel caused by an integer underflow (wraparound) condition in a kernel code path.

This bug allows a locally authenticated attacker with low privileges to trigger incorrect arithmetic handling, leading to unsafe kernel behavior and, ultimately, code execution in a highly privileged context.

Successful exploitation enables the attacker to escalate their privileges from a standard user account to NT AUTHORITY\SYSTEM, granting complete control over the affected Windows host.

PoC for Windows NT OS Kernel Vulnerability

Security researcher alias G4sp4rCS has published a dedicated GitHub repository that includes a working PoC exploit for CVE-2026-42980. This repository contains build scripts, source code, and an English technical write-up.

The source tree includes C code targeting the vulnerable WMI-related kernel path, along with helper files and build tools (Makefile and PowerShell script) for compiling the binary on Windows using MSVC toolchains.

According to the disclosure materials, the exploit is intended for use only on vulnerable lab builds and is explicitly labeled for educational purposes, defensive research, and authorized testing only. It is emphasized that the code should only be run in isolated environments.

This vulnerability is rated as high severity because it requires only local access with low privileges and no user interaction, resulting in complete system compromise if successfully exploited.

With the release of public exploit code, the barrier to weaponization has significantly decreased, making it easier for threat actors to incorporate this technique into post-compromise playbooks for lateral movement and privilege escalation on Windows endpoints and servers.

Common abuse scenarios include deploying the PoC or a modified version after initially gaining access via phishing, browser exploits, or malware. This allows attackers to escape restrictive user contexts and turn off security controls at the kernel level.

Microsoft has released a kernel update addressing CVE-2026-42980 as part of its regular security release cycle. Administrators are urged to apply the corresponding patches across all affected Windows systems without delay.

Organizations should verify patch deployment through their endpoint management platforms, prioritize high-risk multi-user and terminal server environments, and restrict local logon rights to trusted accounts to reduce the pool of users capable of triggering the flaw.

Defenders are further advised to enforce application allow-listing to block the execution of untrusted binaries, monitor for suspicious elevation-of-privilege attempts, and reserve any testing of the PoC code for tightly controlled lab setups.

The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment