Integer underflow

CVE-2026-42980 is an *integer underflow* (CWE-122 heap corruption downstream) in the Windows NT OS Kernel — specifically in a size-calculation path where a caller-controlled length wraps around zero and results in an undersized allocation followed by an oversized copy. The end state is a controllable heap overflow inside ntoskrnl, which competent exploit developers routinely convert to arbitrary kernel read/write and then to a SYSTEM token swap. Affected builds span currently-supported Windows 10 (22H2), Windows 11 (22H2/23H2/24H2), and Windows Server 2019/2022/2025 rollups prior to the June 2026 Patch Tuesday cumulative.

Microsoft's HIGH / 7.8 rating is honest. The CVSS vector AV:L/AC:L/PR:L/UI:N correctly captures a *local, low-privilege, no-user-interaction* LPE — you must already be code-executing on the box as a normal user. That is exactly the profile ransomware affiliates, commodity infostealers, and post-phish operators need. It is not a wormable RCE, and it does not deserve CRITICAL, but downgrading it below HIGH ignores that kernel LPEs are the standard second-stage tool in every real intrusion of the last five years.

Why this verdict

• Local-only vector caps the ceiling. AV:L means no unauthenticated remote path, no worm, no perimeter play. That is the reason this is not CRITICAL.
• Low-priv precondition is trivial in reality. PR:L in an enterprise means "any phished user, any RMM foothold, any Citrix sessionn." This is not real friction against an attacker who has already landed — it is the *default* second-stage condition.
• Role multiplier: workstation — chain succeeds, blast radius is single-host SYSTEM plus stored creds/tokens. Typical.
• Role multiplier: Terminal Server / Citrix VDA / jump box — chain succeeds, blast radius is *every concurrent user session on that host*. 100–1000 users per box in real deployments. Common in finance and healthcare.
• Role multiplier: domain controller — DCs run the same NT kernel. If any low-priv service account can execute code on a DC (BloodHound routinely finds one in 80%+ of AD environments), this chain ends in domain compromise. Floor is HIGH on this basis alone.
• EPSS 0.057 at 92nd percentile signals FIRST expects near-term exploitation attempts. Consistent with the historical LPE-to-KEV base rate.

Why not higher?

Not CRITICAL because the attack requires local code execution as an authenticated user — there is no unauthenticated remote reach, no wormability, and no path from the internet without a prior initial-access foothold. That single friction point (AV:L) is what keeps every Windows kernel LPE out of the CRITICAL bucket in this engine.

Why not lower?

Not MEDIUM because kernel LPEs on Windows are a mandatory ingredient in real intrusions — every current-generation ransomware operator (LockBit-successor crews, Play, Akira, RansomHub) rotates in fresh SYSTEM-primitives quarterly. The universality of the affected component (100% of unpatched Windows hosts) plus the role-multiplier on shared hosts and DCs prevents a downgrade.

1. Deploy the June 2026 cumulative to Tier-0 and shared-session hosts first — DCs, ADCS servers, PAM/Vault hosts, Terminal Servers, Citrix VDAs, and jump boxes are where the role multiplier bites. Prioritize these within the noisgate mitigation SLA of 30 days for HIGH; the residual fleet fits inside the 180-day remediation window.
2. Enforce HVCI + Memory Integrity fleet-wide — HVCI (DeviceGuard\HypervisorEnforcedCodeIntegrity=1) does not stop the primitive but materially raises the exploitation cost by forbidding classic kernel code injection, forcing data-only exploitation. Push via Intune/GPO within the same 30-day window.
3. Tighten application allow-listing (WDAC / AppLocker) on Tier-0 and shared hosts — Blocks the arbitrary user-mode binary that delivers the exploit. Configure with signer + path rules in audit mode first, enforcement within 30 days.
4. Instrument EDR for post-SYSTEM behaviors, not the exploit itself — The kernel primitive is silent. Tune Defender for Endpoint / CrowdStrike detections for LSASS handle acquisition from newly-elevated processes, sc create running as SYSTEM from unusual parents, and Defender-tamper events (Event ID 5001, 5007). This is the reliable catch.
5. Segment jump-box and Terminal Server traffic — Even if SYSTEM is achieved on a jump box, network-layer segmentation (Tier-0 admin-workstation model, RDP restricted to PAWs) limits lateral movement to Tier-0 assets.

Run on each Windows target host as a local admin (or via your endpoint management tool's script channel — Intune Proactive Remediation, SCCM Run Script, Tanium Deploy). Invoke with: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-42980.ps1. The script inspects the installed cumulative update revision against the June 2026 Patch Tuesday floor for each build family.

#requires -Version 5.1
# Check-CVE-2026-42980.ps1
# Determines whether the local host has the June 2026 (or later) Windows cumulative
# addressing CVE-2026-42980 (NT kernel integer underflow -> LPE).
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

# Minimum fixed OS build numbers per family (June 2026 Patch Tuesday, KB506xxxx).
# Adjust these to the exact KB build numbers Microsoft ships for your fleet.
$minBuilds = @{
    # Windows 11 24H2
    '26100' = 4351
    # Windows 11 23H2 / 22H2
    '22631' = 4602
    '22621' = 4602
    # Windows 10 22H2
    '19045' = 5854
    # Server 2025
    '26100.SRV' = 4351
    # Server 2022
    '20348' = 2701
    # Server 2019
    '17763' = 6414
}

try {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $build = [int]$cv.CurrentBuildNumber
    $ubr   = [int]$cv.UBR
    $productName = $cv.ProductName

    $key = if ($productName -match 'Server' -and $build -eq 26100) { '26100.SRV' } else { $build.ToString() }

    if (-not $minBuilds.ContainsKey($key)) {
        Write-Output "UNKNOWN: unrecognized build $build ($productName) - manual review required"
        exit 2
    }

    $required = $minBuilds[$key]
    Write-Output "Host build: $build.$ubr ($productName)"
    Write-Output "Required UBR floor for CVE-2026-42980: $required"

    if ($ubr -ge $required) {
        Write-Output 'PATCHED'
        exit 0
    } else {
        Write-Output 'VULNERABLE'
        exit 1
    }
}
catch {
    Write-Output "UNKNOWN: $($_.Exception.Message)"
    exit 2
}

Sources

1. MSRC advisory (June 2026 Patch Tuesday overview)
2. NVD entry for CVE-2026-42980
3. CISA KEV catalog (verify listing status)
4. FIRST EPSS lookup
5. Microsoft — Enable virtualization-based protection of code integrity (HVCI)
6. Microsoft — Windows Defender Application Control (WDAC)
7. Yarden Shafir — I/O Ring / PipeAttribute pool grooming primitives
8. Microsoft — Securing privileged access / Tier model