CVE-2026-42836: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-42836 Overview

CVE-2026-42836 is a race condition vulnerability in the Windows Function Discovery Service (fdwsd.dll). The flaw stems from concurrent execution using a shared resource without proper synchronization [CWE-362]. An authorized local attacker can exploit the race window to elevate privileges on affected Windows desktop and Windows Server systems. Microsoft has rated the issue HIGH severity. The vulnerability impacts confidentiality, integrity, and availability if successfully exploited. Exploitation requires local access and low privileges, but attack complexity is high because the attacker must reliably win the race condition.

Critical Impact

Successful exploitation allows a low-privileged local user to elevate to higher privileges on Windows 10, Windows 11, and Windows Server systems, gaining full impact on confidentiality, integrity, and availability.

Affected Products

• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) on x86, x64, and ARM64 architectures
• Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1) on x64 and ARM64 architectures
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

• 2026-06-09 - CVE-2026-42836 published to NVD
• 2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-42836

Vulnerability Analysis

The Function Discovery Service in Windows provides a unified API for discovering hardware devices and network resources. The fdwsd.dll library hosts service logic that handles requests from multiple concurrent callers. CVE-2026-42836 arises because the service operates on a shared resource without enforcing proper synchronization between threads. An authorized local user can race the service during the gap between a validation check and the subsequent use of the resource. Winning the race lets the attacker substitute or modify data the service trusts, redirecting privileged operations to attacker-controlled targets. The result is local privilege escalation with full impact on confidentiality, integrity, and availability.

Root Cause

The root cause is improper synchronization of concurrent access to a shared resource inside fdwsd.dll, classified as [CWE-362]. The service does not hold an exclusive lock across the check-and-use sequence, leaving a Time-of-Check to Time-of-Use (TOCTOU) window. An attacker running in parallel can alter the resource state during that window.

Attack Vector

The attack vector is local. An authenticated user with low privileges on the target system runs code that repeatedly triggers Function Discovery Service operations while concurrently modifying the shared resource. Attack complexity is high because the attacker must time operations precisely to win the race. No user interaction is required. Exploitation is performed against the local service and does not require network access.

No public proof-of-concept code is available for this CVE. Refer to the Microsoft Security Update CVE-2026-42836 advisory for further technical details.

Detection Methods for CVE-2026-42836

Indicators of Compromise

• Unexpected child processes spawned by the Function Discovery Service host process or services loading fdwsd.dll
• Local accounts gaining SYSTEM or elevated tokens without a corresponding administrative logon event
• High-frequency, repeated calls to Function Discovery APIs from a single low-privileged user session
• Creation of new privileged accounts, scheduled tasks, or services immediately after suspicious Function Discovery activity

Detection Strategies

• Monitor process creation events (Windows Event ID 4688, Sysmon Event ID 1) for unusual parent-child relationships involving Function Discovery service hosts
• Hunt for token manipulation and privilege assignment events (Event IDs 4672, 4673, 4703) tied to non-administrative users
• Correlate concurrent file or registry handle access patterns that suggest TOCTOU race attempts against service-owned resources
• Track loading of fdwsd.dll by unexpected processes using image-load telemetry

Monitoring Recommendations

• Enable detailed process tracking and Sysmon image-load logging on endpoints and servers running affected Windows versions
• Forward Windows Security and Sysmon events to a centralized analytics platform for correlation across hosts
• Baseline normal Function Discovery Service activity and alert on statistical deviations indicating race attempts
• Review privilege escalation alerts daily until patches are confirmed deployed across the estate

How to Mitigate CVE-2026-42836

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-42836 to all affected Windows 10, Windows 11, and Windows Server systems
• Inventory endpoints and servers running the affected Windows builds and prioritize multi-user and server systems for patching
• Restrict interactive and remote logon rights on sensitive systems to reduce the population of users able to attempt local exploitation
• Audit recent privilege escalation events on affected hosts to identify possible pre-patch exploitation

Patch Information

Microsoft has released a security update addressing CVE-2026-42836. Consult the Microsoft Security Update CVE-2026-42836 advisory for the build numbers and KB articles that apply to each affected Windows version. Deploy through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or your standard patch management workflow.

Workarounds

• No official workaround is published by Microsoft; patching is the recommended remediation path
• Limit local logon rights and remove unnecessary local accounts to shrink the attack surface for local privilege escalation
• Apply application control policies (Windows Defender Application Control, AppLocker) to block unauthorized binaries that could trigger the race condition
• Increase monitoring on systems that cannot be patched immediately and isolate them from sensitive workloads

# Verify patch installation on Windows hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Audit users with local logon rights on a host
whoami /priv
net localgroup Users