CVE-2026-42978: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-42978 Overview

CVE-2026-42978 is a race condition vulnerability in the Windows Push Notifications component. The flaw stems from concurrent execution using a shared resource without proper synchronization [CWE-362]. An authorized local attacker can exploit the timing window to elevate privileges on affected Windows endpoints and servers.

Microsoft rates the issue HIGH with a CVSS 3.1 base score of 7.8. Successful exploitation results in scope change and full compromise of confidentiality, integrity, and availability. The vulnerability affects multiple supported Windows 10, Windows 11, and Windows Server releases.

Critical Impact
A local, low-privileged attacker who wins the race can elevate to SYSTEM, breaking out of the original security context and gaining full control of the host.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2019, 2022, and 2025

Discovery Timeline

2026-06-09 - CVE-2026-42978 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-42978

Vulnerability Analysis

The Windows Push Notifications service (WpnService) coordinates toast and tile notifications for user and system contexts. The component manages shared notification objects that are accessible across security boundaries. The vulnerability arises when two or more threads access these shared resources without correct locking, producing a time-of-check to time-of-use (TOCTOU) condition.

An attacker running as a standard authorized user can race a privileged operation to manipulate a shared state object between validation and use. Because the issue causes a scope change, code executes under a context broader than the attacker's starting privileges. The result is local elevation of privilege to SYSTEM or another higher-integrity context.

The attack complexity is rated High, reflecting the precision required to win the race. Reliable exploitation typically requires multiple attempts and tuning to specific hardware timing. No public proof-of-concept has been published, and the EPSS probability remains low.

Root Cause

The root cause is improper synchronization on a shared resource within Windows Push Notifications [CWE-362]. Missing or incorrect locking allows concurrent threads to mutate state that another thread has already validated, violating expected atomicity.

Attack Vector

Exploitation requires local access and a low-privileged account. No user interaction is needed. The attacker triggers notification operations while concurrently modifying shared objects to corrupt the security context used by the privileged worker.

No verified exploitation code is published for CVE-2026-42978. Refer to the Microsoft CVE-2026-42978 Update advisory for vendor technical details.

Detection Methods for CVE-2026-42978

Indicators of Compromise

Unexpected child processes spawned from WpnService.dll or wpnuserservice.exe running with SYSTEM integrity
Repeated, high-frequency calls to push notification APIs from a single non-administrative process, consistent with race-window probing
New service installations, scheduled tasks, or persistence artifacts created shortly after notification-related activity by a non-admin user

Detection Strategies

Hunt for process trees where a standard user process leads to a SYSTEM-context child via svchost.exe hosting the Push Notifications service
Correlate Sysmon Event ID 1 (process create) and Event ID 10 (process access) targeting WpnService with token elevation events (Security Event ID 4673, 4688)
Baseline normal Push Notifications API call volume per process and alert on statistical outliers indicative of race-condition brute forcing

Monitoring Recommendations

Enable PowerShell and command-line auditing to capture post-exploitation activity following any suspicious notification service interaction
Forward Windows Security, Sysmon, and Microsoft-Windows-PushNotifications-Platform/Operational logs to a central SIEM for cross-host correlation
Track newly created local administrator accounts, service modifications, and integrity-level transitions across endpoints

How to Mitigate CVE-2026-42978

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-42978 Update advisory to all affected Windows 10, Windows 11, and Windows Server systems
Prioritize patching multi-user systems, terminal servers, and VDI hosts where local low-privileged access is common
Audit local user accounts and remove unnecessary interactive logon rights to reduce the population of potential attackers

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Administrators should deploy the corresponding cumulative update for each affected Windows build via Windows Update, WSUS, Microsoft Update Catalog, or Intune. Verify successful installation by checking the OS build number against the version listed in the vendor advisory.

Workarounds

No official workaround is documented by Microsoft; patching is the supported remediation path
Restrict interactive and Remote Desktop logon rights to trusted administrative users where business requirements allow
Apply application control policies such as Windows Defender Application Control (WDAC) or AppLocker to block unauthorized binaries that could host exploitation code

bash

# Verify patch level on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Confirm the running OS build matches the patched version listed in MSRC
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR