Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 13 products
| Date | Total | Labels |
|---|
| 2026-06-10 | 2 | General1Patch1 |
| 2026-07-05 | 1 | Disclosure1 |
| 2026-07-07 | 1 | PoC1 |
| 2026-07-19 | 1 | PoC1 |
| 2026-07-21 | 2 | PoC2 |
| 2026-07-22 | 3 | General1PoC2 |
| 2026-07-23 | 2 | PoC2 |
| 2026-07-24 | 2 | PoC2 |
| 2026-07-30 | 1 | PoC1 |
| 2026-08-06 | 1 | Patch1 |
| 2026-08-17 | 1 | Active Exploitation1 |
| 2026-08-19 | 1 | PoC1 |
| 2026-09-17 | 1 | Exploit1 |
| 2026-09-19 | 3 | Exploit1PoC2 |
CVE-2026-42980 Windows 内核 WMI 整数下溢本地提权漏洞，低权限攻击者可利用该漏洞将自身权限提升至 SYSTEM，进而完全控制受影响主机。 (切记，运行第二次poc存在蓝屏概率) https://github.com/G4sp4rCS/CVE-2026-42980-POC https://t.co/WGKa8USQvD
Post summary
The tweet highlights a GitHub PoC for the CVE-2026-42980 Windows kernel WMI integer overflow privilege escalation, describing the exploit mechanics and a note about potential blue screens on repeated runs.
This repository contains public disclosure material for CVE-2026-42980, a Windows kernel WMI integer-underflow vulnerability that can be exploited for local privilege escalation to NT AUTHORITY\SYSTEM on vulnerable lab builds. poc released by G4sp4rCS :- https://github.com/G4sp4rCS/CVE-2026-42980-POC https://t.co/8Edm2j92HH
Post summary
The repository discloses CVE-2026-42980, a Windows kernel WMI integer-underflow leading to local privilege escalation, and a PoC exploit has been released by G4sp4rCS.
CVE-2026-42980, a Windows kernel WMI integer-underflow vulnerability that can be exploited for local privilege escalation to NT AUTHORITY\SYSTEM on vulnerable lab builds. https://github.com/G4sp4rCS/CVE-2026-42980-POC
Post summary
A newly disclosed Windows kernel WMI integer-underflow vulnerability (CVE‑2026‑42980) that allows local privilege escalation to SYSTEM is accompanied by a PoC available on GitHub.
Another Windows kernel LPE got full public source!! CVE-2026-42980: integer underflow in the NT OS Kernel lets a low-priv local user reach SYSTEM. Researcher dropped complete source, build scripts, and write-up. Ready-to-compile public material changes the risk overnight. https://cybersecuritynews.com/poc-windows-nt-os-kernel/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WindowsInternals #PrivilegeEscalation
Post summary
The post announces that a Windows kernel LPE vulnerability (CVE-2026-42980) has public exploit source code available, including build scripts and write-up, significantly increasing risk.
CVE-2026-42980 için Windows Kernel WMI bileşenindeki integer-underflow açığına yönelik LPE PoC'si. Bu açık, yamalanmamış Windows 10/11/ Server sistemlerinde, yerel saldırganın kernel seviyesinde işlem gerçekleştirerek NT AUTHORITY\SYSTEM yetkisine yükselmesine izin veriyor. https://github.com/G4sp4rCS/CVE-2026-42980-POC
Post summary
The tweet announces a proof‑of‑concept for CVE‑2026‑42980, an integer‑underflow in the Windows Kernel WMI that allows local privilege escalation to SYSTEM on unpatched Windows 10/11/Server systems, with a GitHub link to the PoC.
A public PoC for CVE-2026-42980 details a Windows privilege escalation flaw in the kernel WMI code. It grants SYSTEM on unpatched builds. #CVE202642980 #Windows #PrivilegeEscalation #Infosec #Cybersecurity http://securityonline.info/cve-2026-42980-privilege-escalation/
Post summary
A public PoC for CVE-2026-42980 demonstrates a Windows kernel WMI privilege‑escalation flaw that grants SYSTEM rights on unpatched builds, with technical details provided but no exploit code or active exploitation reports.
A PoC/exploit has been discovered for vulnerability CVE-2026-42980 PT ID: PT-2026-47906 Vendor: Microsoft Product: Windows 10 Version 1607 Description: Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-47906 • https://github.com/G4sp4rCS/CVE-2026-42980-POC #dbugs_vuln
Post summary
A proof‑of‑concept and exploit code for CVE‑2026‑42980, an integer underflow privilege‑escalation flaw in Windows 10 1607, have been released, but no active exploitation or patch guidance is reported.
CVE-2026-42980: Windows kernel LPE via WMI integer underflow. 32-bit counter wraps → OOB write → npfs pipe corruption → kernel leak → arbitrary read → token swap → SYSTEM. Tested on vulnerable lab builds. https://github.com/G4sp4rCS/CVE-2026-42980-POC #infosec #Windows
Post summary
The tweet announces CVE‑2026‑42980, details the exploitation chain, and provides a GitHub PoC link, indicating a functional exploit is available.
Windows NT Kernel için CVE-2026-42980 PoC Integer Underflow kaynaklı bu LPE açığı, yerel erişime sahip düşük yetkili bir kullanıcının SYSTEM yetkisi kazanmasına olanak tanıyor. Microsoft Haziran 2026 güncellemeleriyle bu açığı yamaladı. https://github.com/G4sp4rCS/CVE-2026-42980-POC
Post summary
A proof‑of‑concept for CVE‑2026‑42980 is shared via GitHub, detailing an Integer Underflow LPE, and Microsoft has released a June 2026 patch for it.
CVE-2026-42980 PoC Exposes Windows Privilege Escalation - https://securityonline.info/cve-2026-42980-privilege-escalation/
Post summary
A proof‑of‑concept showing Windows privilege escalation for CVE‑2026‑42980 has been published, but the post offers no exploit code, patch information, or evidence of active exploitation.
CVE-2026-42980: A PoC/exploit has been discovered for vulnerability CVE-2026-42980 PT ID: PT-2026-47906 Vendor: Microsoft Product: Windows 10 Version 1607 Description: Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate…
Post summary
A Proof of Concept for CVE-2026-42980, an integer underflow in the Windows NT kernel, has been discovered, potentially allowing privilege escalation for authorized attackers.
Source: X search for PoC exploit 2026 Posted: 2026-07-07T07:05:36.000Z Likes: 25 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-42980
Post summary
A PoC/exploit has been announced for CVE-2026-42980, but no additional technical details or exploit code are included.
CVE-2026-42980 NT OS Kernel Elevation of Privilege Vulnerability PWNED! https://t.co/YeddEZuv0u
Post summary
A tweet announces the CVE-2026-42980 kernel elevation of privilege vulnerability, provides a link, but offers no PoC, exploit code, or patch information.
#windowsupdate #microsoft ●悪用可能性 －悪用の事実を確認済み：0 件 －悪用される可能性が高い：14 件 ・CVE-2026-42905 7.8 Windows DWM Core ライブラリ ・CVE-2026-42980 7.8 Windows NT OS カーネル つづく… https://x.com/kawn2020/status/2064629746538008881
Post summary
The post lists two high‑risk CVEs (CVE-2026-42905 and CVE-2026-42980) with CVSS 7.8 scores but confirms no real‑world exploitation, offering no PoC, exploit code, or patch information. The content serves mainly as a risk awareness announcement rather than a disclosure or active‑exploitation report.
⚡️ August "In the Trend of VM" (#30): 4 trending vulns - ViPNet Client RCE (BDU:2026-09885), Windows Kernel EoP (CVE-2026-42980), and 2 actively exploited SharePoint flaws (CVE-2026-56164, CVE-2026-58644). #TrendVulns #ViPNet #Windows #SharePoint ➡️ https://avleonov.com/2026/08/17/i130-august-in-the-trend-of-vm-30-vulnerabilities-in-vipnet-client-the-microsoft-windows-kernel-and-microsoft-sharepoint/ https://t.co/hkjhFAqNCV
Post summary
The post highlights four trending vulnerabilities, noting that two SharePoint flaws are actively exploited; it provides some technical details but no PoC, exploit code, patch, or debunking information.
🚨 Windows NT OS Kernel EoP (CVE-2026-42980): local privilege escalation via WMI out-of-bounds write, patched in June Microsoft Patch Tuesday, public PoC released, no active exploitation observed. #Microsoft #Windows #Vulnerability ➡️ https://avleonov.com/2026/08/06/i118-about-elevation-of-privilege-nt-os-kernel-cve202642980-vulnerability/ https://t.co/QefPnJF2pR
Post summary
CVE-2026-42980 is a Windows NT kernel elevation of privilege flaw that was patched in June, a public PoC is available, and no active exploitation has been reported.
Windows NT OS Kernel の権限昇格の脆弱性 CVE-2026-42980：PoC の公開と悪用リスクの増大 https://iototsecnews.jp/2026/07/22/public-poc-released-for-windows-nt-os-kernel-privilege-escalation-vulnerability/ 今回の問題は、Windows NT OS Kernel 内の特定のコードパスで発生する整数アンダーフロー (wraparound) の不具合に起因します。プログラム内で数値を処理する際に、想定外の回り込みが生じることで、不正な算術処理が実行されてしまいます。これによりカーネルが予期しない挙動を起こし、低権限のアクセスからでも最高権限である SYSTEM 権限へと到達できるルートが作られてしまいます。このデータ処理時の適切な検証の欠落による権限昇格の脆弱性は、CVE-2026-42980 として報告され、修正されています。 #CVE202642980 #Microsoft #PoC #Vulnerability #WindowsNTOSKernel
Post summary
A PoC has been released for CVE-2026-42980, exposing an integer underflow privilege escalation bug in the Windows NT OS Kernel. The vulnerability has been patched, but the release highlights an elevated risk.
WindowsのNT OSカーネル権限昇格 脆弱性 CVE-2026-42980のPoCが公開 https://rocket-boys.co.jp/security-measures-lab/windows-kernel-cve-2026-42980-poc-analysis/ #セキュリティ対策Lab #security #securitynews #脆弱性
Post summary
A proof of concept for the Windows NT OS kernel privilege escalation CVE-2026-42980 has been published online, providing technical details but no evidence of active exploitation or patches.
🚨 Public PoC Released for Windows NT OS Kernel Privilege Escalation A working proof-of-concept exploit for CVE-2026-42980 (integer underflow in Windows NT Kernel) is now public on GitHub. Low-privileged local attackers can escalate to NT AUTHORITY\SYSTEM, achieving full system control. PoC by G4sp4rCS includes source code, build scripts & technical write-up. Patch urgently.
Post summary
A PoC for CVE-2026-42980, including source code and scripts, has been released on GitHub, and readers are urged to apply a patch.
A public PoC exploit for CVE-2026-42980, a critical Windows NT kernel privilege escalation vulnerability, has been released. This flaw allows local attackers to gain SYSTEM-level access. Immediate patching is essential to prevent potential exploitation. #CVE202642980 #WindowsNT #PrivilegeEscalation #CyberSecurity #InfoSec #Microsoft https://thedailytechfeed.com/public-poc-released-for-windows-nt-kernel-privilege-escalation/
Post summary
A public PoC exploit for the critical Windows NT kernel privilege escalation CVE-2026-42980 has been released, and users are urged to patch immediately to prevent potential exploitation.
24 of 24 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | arm64 |
| OS | microsoft | windows_10_21h2 | - | - | x64 |
| OS | microsoft | windows_10_21h2 | - | - | x86 |
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_23h2 | - | - | arm64 |
| OS | microsoft | windows_11_23h2 | - | - | x64 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_11_25h2 | - | - | arm64 |
| OS | microsoft | windows_11_25h2 | - | - | x64 |
| OS | microsoft | windows_11_26h1 | - | - | arm64 |
| OS | microsoft | windows_11_26h1 | - | - | x64 |
| OS | microsoft | windows_server_2012 | - | - | - |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | x64 |