CVE-2026-42984 Overview
CVE-2026-42984 is a use-after-free vulnerability [CWE-416] in the Microsoft Windows Kernel. An authenticated local attacker can exploit the flaw to elevate privileges to SYSTEM. The vulnerability affects supported releases of Windows 10, Windows 11, and Windows Server. Microsoft has acknowledged the issue and published guidance through its Security Update Guide.
The weakness involves the kernel referencing memory after it has been freed. Successful exploitation grants full control over the affected host, including the ability to disable security tooling, install drivers, and persist on the system.
Critical Impact
A successful exploit promotes a low-privileged local account to SYSTEM, giving attackers full control over the affected Windows host.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) — x86, x64, ARM64
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) — x64 and ARM64
- Microsoft Windows Server 2019, 2022, and 2025
Discovery Timeline
- 2026-06-09 - CVE-2026-42984 published to the National Vulnerability Database
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-42984
Vulnerability Analysis
The Windows Kernel mismanages the lifetime of an internal object, releasing the underlying allocation while a reference to it remains reachable. When the kernel later dereferences the stale pointer, the freed memory may have been reused by an attacker-controlled allocation. This produces a classic use-after-free condition [CWE-416] in a privileged execution context.
Exploitation requires local access and low-privileged authentication on the target. The attack complexity is rated high because the attacker must win a timing window and groom kernel pools to place controlled data into the freed slot. Once the kernel operates on the attacker-controlled object, the adversary gains arbitrary kernel read/write primitives, enabling token replacement and SYSTEM-level execution.
EPSS currently estimates a low near-term exploitation probability of 0.055%, but kernel use-after-free flaws are historically attractive targets for offensive tooling and post-compromise privilege escalation.
Root Cause
The root cause is improper reference counting or object lifetime tracking inside a Windows Kernel component. A code path frees an object while another path retains and later uses the same pointer. Microsoft's advisory in the MSRC update guide is the authoritative source for the affected subsystem.
Attack Vector
The attack vector is local. An attacker who already holds valid credentials on the system — for example, a standard user account obtained through phishing, credential theft, or initial access tooling — runs a crafted program that triggers the vulnerable kernel path. The exploit does not require user interaction beyond execution of the attacker's binary.
No public proof-of-concept code is available at this time. Refer to the Microsoft Security Update Guide for CVE-2026-42984 for vendor technical details.
Detection Methods for CVE-2026-42984
Indicators of Compromise
- Unexpected child processes of lsass.exe, winlogon.exe, or other SYSTEM-context binaries spawned by a standard-user session.
- Sudden token elevation of a user-mode process from a medium integrity level to SYSTEM without an associated UAC prompt or service start.
- Kernel bug check events (BSOD) with stop codes referencing pool corruption or DRIVER_VERIFIER_DETECTED_VIOLATION shortly after running an untrusted binary.
- Unsigned or newly dropped executables in user-writable paths invoking NtQuerySystemInformation and pool-spraying syscalls in rapid succession.
Detection Strategies
- Hunt for processes whose parent is a non-elevated user shell but whose token shows the SYSTEM SID, indicating post-exploit token theft.
- Correlate Windows Event Log IDs 4688 (process creation) and 4672 (special privileges assigned) where the same user session transitions from low to high privileges.
- Apply behavioral analytics to flag user-mode binaries that make a high volume of object handle creation and free calls characteristic of pool grooming.
Monitoring Recommendations
- Enable Kernel-Mode Driver Framework and Driver Verifier auditing on high-value hosts to surface kernel memory anomalies during testing.
- Forward Sysmon Event IDs 1, 10, and 13 to a centralized analytics platform and alert on cross-integrity-level process access patterns.
- Track installation of new kernel drivers and unexpected loads from non-standard paths.
How to Mitigate CVE-2026-42984
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-42984 to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching multi-user systems, jump hosts, and developer workstations where local accounts already exist.
- Restrict the ability of standard users to execute unsigned binaries via Windows Defender Application Control or AppLocker.
- Rotate credentials on any host showing indicators consistent with kernel exploitation while investigation is in progress.
Patch Information
Microsoft has published a security update through the Microsoft Security Update Guide. Administrators should deploy the cumulative update corresponding to each Windows build via Windows Update, WSUS, or Microsoft Update Catalog.
Workarounds
- No vendor-supplied workaround replaces the patch. If patching must be delayed, reduce the local attack surface by removing unnecessary local user accounts and enforcing least privilege.
- Block execution of untrusted binaries in user-writable directories using Software Restriction Policies or Windows Defender Application Control.
- Enable attack surface reduction rules that restrict process creation from Office and script interpreters to limit initial access avenues that precede local privilege escalation.
# Verify installed update on a Windows host (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
