NT OS Kernel Elevation of Privilege via WMI Integer Underflow

CVE-2026-42980 is an integer underflow in the Windows NT kernel's WMI serialization layer — specifically in nt!WmipQuerySingleMultiple and nt!WmipQueryAllDataMultiple inside ntoskrnl.exe. When processing multi-instance WMI queries through IOCTL 0x228130 on \Device\WMIDataDevice, the kernel subtracts an aligned provider-reported record size from a 32-bit remaining-output counter *without checking whether the subtraction would go negative*. The unsigned result wraps to a massive value (~0xFFFFFFFC), blowing past all subsequent boundary checks and enabling a controlled heap-based buffer overflow. Affected versions span Windows 10 Version 1607 through current, Windows 11 22H2–26H1, and Windows Server 2012 through 2025 — essentially every supported Windows release. A weaponized public PoC by researcher G4sp4rCS was released around July 7, 2026, roughly four weeks after Microsoft's June 2026 Patch Tuesday fix.

Microsoft rated this Important / 7.8 HIGH with an "Exploitation More Likely" exploitability assessment — and that call is reasonable but slightly optimistic given the current threat landscape. The vendor's temporal score of 6.8 was set with E:U (Unproven exploit code); that assumption is now stale. The PoC demonstrates a reliable multi-stage chain: named-pipe pool grooming → WMI underflow trigger → NP_DATA_QUEUE_ENTRY corruption → arbitrary kernel read/write → SYSTEM token theft. The local/authenticated prerequisite applies genuine friction against drive-by exploitation, but this is *exactly* the kind of post-access privilege escalation that ransomware operators and red teams weaponize immediately. On domain controllers and other identity-tier hosts, SYSTEM access is functionally equivalent to domain admin. We keep the vendor's HIGH 7.8 as the correct severity — but flag it as an urgent HIGH that should not be deprioritized just because it's "only local."

Sources.

1. Microsoft Security Response Center — CVE-2026-42980
2. G4sp4rCS PoC — CVE-2026-42980-POC (GitHub)
3. CVE Reports — Technical Analysis
4. Senserva — CVE-2026-42980 Patch Details and Affected Versions
5. Talos Intelligence — June 2026 Patch Tuesday Snort Rules
6. Mallory.ai — Public PoC Enables SYSTEM Privilege Escalation
7. Tenable — CVE-2026-42980
8. Strix.ai — CVE-2026-42980 Heap Buffer Overflow Analysis

Run this script on each target Windows host as any user (no admin required for hotfix enumeration). Invoke with: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-42980.ps1. The script checks whether any of the 10 fixing KBs from June 2026 Patch Tuesday are installed, or whether a superseding cumulative update has been applied.

# Check-CVE-2026-42980.ps1
# Verifies whether the host is patched against CVE-2026-42980
# NT OS Kernel integer underflow -> Elevation of Privilege
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

$fixingKBs = @(
    'KB5093998',
    'KB5094041',
    'KB5094042',
    'KB5094122',
    'KB5094123',
    'KB5094125',
    'KB5094126',
    'KB5094127',
    'KB5094128',
    'KB5095051'
)

try {
    $installed = @()
    try {
        $installed = Get-HotFix -ErrorAction SilentlyContinue |
            Select-Object -ExpandProperty HotFixID
    } catch {
        # Fallback to CIM/WMI
        $installed = (Get-CimInstance -ClassName Win32_QuickFixEngineering -ErrorAction SilentlyContinue).HotFixID
    }

    if (-not $installed -or $installed.Count -eq 0) {
        Write-Host 'UNKNOWN - Could not enumerate installed hotfixes.'
        exit 2
    }

    $matched = $fixingKBs | Where-Object { $installed -contains $_ }

    if ($matched.Count -gt 0) {
        Write-Host "PATCHED - Found fixing update(s): $($matched -join ', ')"
        exit 0
    }

    # Check for superseding cumulative update (July 2026 or later)
    $laterCU = Get-HotFix -ErrorAction SilentlyContinue |
        Where-Object {
            $_.InstalledOn -and $_.InstalledOn -ge [DateTime]'2026-07-01'
        } |
        Sort-Object InstalledOn -Descending |
        Select-Object -First 1

    if ($laterCU) {
        Write-Host "PATCHED - Superseding cumulative update found: $($laterCU.HotFixID) installed $($laterCU.InstalledOn.ToString('yyyy-MM-dd'))"
        exit 0
    }

    Write-Host "VULNERABLE - None of the fixing KBs are installed and no superseding CU found."
    Write-Host "Fixing KBs: $($fixingKBs -join ', ')"
    Write-Host 'Action: Apply the June 2026 cumulative update for your OS version.'
    exit 1

} catch {
    Write-Host "UNKNOWN - Error during check: $($_.Exception.Message)"
    exit 2
}