Windows WalletService Elevation of Privilege via ESE Persisted Callback Abuse

#Requires -Version 3.0
<#
  Check-CVE-2026-49176.ps1
  Checks whether the host is vulnerable to CVE-2026-49176
  (Windows WalletService LPE via ESE persisted callbacks).
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

try {
    $build = [int](Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name CurrentBuildNumber).CurrentBuildNumber
    $ubr   = [int](Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR

    # Map build families to fixed UBR thresholds
    $fixedUBR = switch ($build) {
        14393  { 9339  }   # Win 10 1607 / Server 2016
        17763  { 9020  }   # Win 10 1809 / Server 2019
        19044  { 7548  }   # Win 10 21H2
        19045  { 7548  }   # Win 10 22H2
        20348  { 5386  }   # Server 2022
        26100  { 8875  }   # Win 11 24H2 / Server 2025 (client branch)
        26200  { 8875  }   # Win 11 25H2
        28000  { 2269  }   # Win 11 26H1
        default { $null }
    }

    # Check WalletService state
    $svcDisabled = $false
    try {
        $svc = Get-Service -Name WalletService -ErrorAction Stop
        if ($svc.StartType -eq 'Disabled') { $svcDisabled = $true }
    } catch {
        # Service not found (Server Core or removed) - not vulnerable
        Write-Host 'PATCHED - WalletService not present (Server Core or removed).'
        exit 0
    }

    if ($null -eq $fixedUBR) {
        if ($svcDisabled) {
            Write-Host "PATCHED - Build $build.$ubr is not in the known affected range, and WalletService is disabled."
            exit 0
        }
        Write-Host "UNKNOWN - Build $build.$ubr is not in the known affected build family list. Manual review required."
        exit 2
    }

    $patched = $ubr -ge $fixedUBR

    if ($patched) {
        Write-Host "PATCHED - Build $build.$ubr meets or exceeds fixed UBR $fixedUBR."
        exit 0
    } elseif ($svcDisabled) {
        Write-Host "VULNERABLE (MITIGATED) - Build $build.$ubr is below fixed UBR $fixedUBR, but WalletService is disabled."
        exit 0
    } else {
        Write-Host "VULNERABLE - Build $build.$ubr is below fixed UBR $fixedUBR and WalletService is enabled."
        exit 1
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}