Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-10 | 1 | Patch1 |
| 2026-06-24 | 1 | PoC1 |
| 2026-07-16 | 2 | PoC2 |
| 2026-07-27 | 1 | PoC1 |
| 2026-07-28 | 1 | PoC1 |
| 2026-09-12 | 1 | Exploit1 |
Windows Push Notifications Use-After-Free CVE-2026-42978 Proof-of-Content and Research https://github.com/grizzzer/CVE-2026-42978-PoC-Research
Post summary
A GitHub repository containing a Proof‑of‑Concept for the Windows Push Notifications Use‑After‑Free CVE‑2026‑42978 is referenced, but no active exploitation or patch information is provided.
🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-42978 PT ID: PT-2026-47904 Vendor: Microsoft Product: Windows 10 Version 1809 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. Link: https://github.com/grizzzer/CVE-2026-42978-PoC-Research #dbugs_vuln
Post summary
A proof-of-concept exploit for CVE-2026-42978 has been released, demonstrating a local privilege escalation via a race condition in Windows Push Notifications; the PoC code is available on GitHub.
''GitHub - grizzzer/CVE-2026-42978-PoC-Research: CVE-2026-42978 — Use-After-Free race condition in Windows Push Notifications (WpnService). Patch diff, root cause analysis, TOCTOU lab, Sysmon/ETW detection rules.'' #infosec #pentest #redteam #blueteam https://github.com/grizzzer/CVE-2026-42978-PoC-Research
Post summary
The GitHub repository provides a PoC, patch diff, and root cause analysis for CVE‑2026‑42978, with no evidence of active exploitation or functional exploit code.
Vendor. 0day Intel: 🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-42978 PT ID: PT-
Post summary
A Proof of Concept for CVE-2026-42978 has been discovered, but the post offers no deeper technical detail, exploit code, or patch information.
CVE-2026-42978. 0day Intel: 🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-42978 PT ID: PT-
Post summary
The post announces that a Proof of Concept for CVE‑2026‑42978 has been found, but does not provide any code, exploitation details, or mitigation steps.
CVE-2026-42978 Exploit Code Hits GitHub, Local Privilege Escalation in Windows Push Notifications Is Now Public https://cybrmonk.com/blog/cve-2026-42978-exploit-code-hits-github-local-privilege-escalation-in-windows-push-notifications-is-now-public #cybersecurity #threatintelligence https://t.co/V3ZUeJmbuX
Post summary
A publicly available exploit for CVE‑2026‑42978, enabling local privilege escalation through Windows Push Notifications, has been released to GitHub, but no evidence of active exploitation or patch guidance is mentioned.
🪟 Windows Push Notifications getting a Local SYSTEM EoP fix = cool, so “harmless” alerts can still hand attackers the keys. Not RCE, but it’s the same old door-to-SYSTEM playbook. #Windows #Microsoft #CVE https://windowsforum.com/threads/cve-2026-42978-windows-push-notifications-local-system-privilege-escalation-fix.424861/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #PrivilegeEscalation https://t.co/Np1tYApK43
Post summary
Microsoft has released a fix for CVE‑2026‑42978, a Windows Push Notifications local SYSTEM privilege‑escalation vulnerability; no evidence of active exploitation or PoC is provided.
19 of 19 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | arm64 |
| OS | microsoft | windows_10_21h2 | - | - | x64 |
| OS | microsoft | windows_10_21h2 | - | - | x86 |
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_23h2 | - | - | arm64 |
| OS | microsoft | windows_11_23h2 | - | - | x64 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_11_25h2 | - | - | arm64 |
| OS | microsoft | windows_11_25h2 | - | - | x64 |
| OS | microsoft | windows_11_26h1 | - | - | arm64 |
| OS | microsoft | windows_11_26h1 | - | - | x64 |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | x64 |