Public PoC Released for Windows NT OS Kernel Privilege Escalation Vulnerability
A public proof-of-concept exploit is now available for CVE-2026-42980, a high-severity local privilege escalation vulnerability in the Windows NT OS Kernel.
A public proof-of-concept (PoC) exploit has been released for CVE-2026-42980, a critical local privilege escalation vulnerability affecting the Windows NT OS Kernel. The flaw stems from an integer underflow condition within a kernel code path, allowing a low-privilege local attacker to gain SYSTEM-level privileges.
Security researcher G4sp4rCS has published a GitHub repository containing the PoC, including build scripts, source code written in C, and a technical write-up. The exploit targets a vulnerable WMI-related kernel path and is designed for educational purposes and defensive research, with explicit warnings against its use outside of isolated lab environments.
The vulnerability is classified as high severity due to its local access requirement with low privileges and no user interaction needed for exploitation. Successful exploitation grants an attacker complete control over the affected Windows host by escalating privileges to NT AUTHORITY\SYSTEM.
The release of public exploit code significantly lowers the barrier for threat actors to weaponize this vulnerability. It can be integrated into post-compromise tactics to achieve lateral movement and elevate privileges on Windows endpoints and servers, enabling attackers to disable security controls at the kernel level.
Microsoft has addressed CVE-2026-42980 in its latest security release cycle. Administrators are strongly advised to apply the provided patches immediately across all affected Windows systems. Verification of patch deployment and prioritization of high-risk environments, such as multi-user and terminal servers, are crucial.
Further mitigation strategies include restricting local logon rights to trusted accounts, enforcing application allow-listing to prevent the execution of untrusted binaries, and monitoring for suspicious privilege escalation attempts. Organizations should reserve any testing of the PoC code for strictly controlled laboratory setups.
This vulnerability highlights the persistent threat of privilege escalation flaws within operating system kernels. While patches are available, the public availability of exploit code necessitates immediate action to protect systems from potential compromise and further lateral movement by adversaries.