CVE-2026-42973: Windows 10 Information Disclosure Flaw

CVE-2026-42973 Overview

CVE-2026-42973 is an information disclosure vulnerability in the Windows Push Notifications component. The flaw stems from the use of an uninitialized resource [CWE-200], which allows an authorized local attacker to read memory contents that should not be exposed. Microsoft confirmed the issue affects supported Windows 10, Windows 11, and Windows Server releases. Exploitation requires local access and low-privileged authentication, and no user interaction is needed. The vulnerability impacts confidentiality only — integrity and availability remain unaffected.

Critical Impact

An authorized local attacker can read uninitialized memory from the Windows Push Notifications subsystem, potentially disclosing sensitive in-process data across a wide range of Windows client and server versions.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
• Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

• 2026-06-09 - CVE-2026-42973 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-42973

Vulnerability Analysis

The vulnerability resides in the Windows Push Notifications service, which delivers toast and tile notifications to applications via the Windows Notification Platform. The component allocates a resource — typically a memory buffer or kernel object field — without initializing all of its bytes before returning data to a caller. When the service exposes that resource through an interprocess interface, residual bytes from previous allocations leak into the caller's address space. An authorized user running code on the local machine can repeatedly invoke the affected interface to harvest these residual bytes. The vulnerability is classified as Information Exposure under [CWE-200] and aligns with the broader class of Uninitialized Memory Use issues.

Root Cause

The root cause is a missing initialization step in the Push Notifications code path. Structures or buffers allocated on the heap or stack contain stale data from prior operations. The affected routine copies the entire structure into an output channel without zeroing or fully populating each field. Padding bytes and reserved fields are the most common sources of leaked content in defects of this type.

Attack Vector

Exploitation requires local code execution under an authenticated user account. The attacker calls into the Push Notifications interface from a standard user context and inspects returned buffers for leaked memory. The disclosed bytes may include pointers useful for bypassing Address Space Layout Randomization (ASLR), tokens, or fragments of sensitive in-process state. No public proof-of-concept is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. Refer to the Microsoft CVE-2026-42973 Advisory for vendor technical details.

Detection Methods for CVE-2026-42973

Indicators of Compromise

• Unexpected processes repeatedly invoking the WpnService or WpnUserService interfaces from non-notification-related binaries.
• Local user processes performing high-frequency calls into Push Notifications RPC endpoints.
• Memory dumps from user-mode processes containing unrelated kernel or service-owned data fragments.

Detection Strategies

• Monitor for unusual child processes or thread activity originating from WpnUserService.dll clients running under standard user accounts.
• Correlate Event Tracing for Windows (ETW) provider data from the Push Notifications subsystem against established application baselines.
• Flag binaries that load notification client libraries but are not associated with UWP or Win32 notification publishers.

Monitoring Recommendations

• Enable Windows audit logging for RPC interface access tied to the Push Notifications service.
• Track patch deployment status across all listed Windows 10, Windows 11, and Windows Server builds.
• Alert on local processes that read large volumes of data from notification IPC endpoints without producing corresponding UI activity.

How to Mitigate CVE-2026-42973

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft CVE-2026-42973 Advisory to all affected Windows 10, Windows 11, and Windows Server systems.
• Prioritize multi-user systems, terminal servers, and shared workstations where local authenticated access is broad.
• Restrict local logon rights to trusted accounts and enforce least privilege on interactive sessions.

Patch Information

Microsoft has released security updates addressing CVE-2026-42973 across all impacted Windows releases. Administrators should consult the Microsoft CVE-2026-42973 Advisory for the specific KB article and build numbers that apply to each supported version, then deploy through Windows Update, WSUS, or the organization's patch management workflow.

Workarounds

• No official workaround has been published by Microsoft. Patching is the supported remediation path.
• Where patching must be delayed, limit local interactive and remote desktop access to administrative personnel only.
• Use application control policies such as Windows Defender Application Control (WDAC) or AppLocker to block untrusted local binaries from invoking notification APIs.

# Verify the installed Windows build to confirm patch level
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"