CVE-2026-42991 Overview
CVE-2026-42991 is a race condition vulnerability in the Windows Push Notifications service. An authorized local attacker can exploit improper synchronization of shared resources to elevate privileges on affected Windows systems. The flaw is tracked under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). Successful exploitation impacts confidentiality, integrity, and availability with a scope change, indicating that the compromised component can affect resources beyond its security authority. Microsoft addressed the issue through its security update guide.
Critical Impact
Local authenticated users can win a race condition in Windows Push Notifications to gain elevated privileges, breaking the security boundary between user and system contexts.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) on x86, x64, and ARM64
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
- Microsoft Windows Server 2019, 2022, and 2025
Discovery Timeline
- 2026-06-09 - CVE-2026-42991 published to NVD
- 2026-06-11 - Last updated in NVD database
Technical Details for CVE-2026-42991
Vulnerability Analysis
The vulnerability resides in the Windows Push Notifications component, which handles toast and tile notifications for applications. Multiple threads access shared resources without adequate locking, creating a window where state can be manipulated between validation and use. An attacker with local, low-privileged access can trigger concurrent operations to corrupt internal state and execute code in a higher-privileged context. The scope change in the impact metrics indicates the exploit crosses a trust boundary, enabling the attacker to influence resources outside the Push Notifications service itself.
Root Cause
The root cause is improper synchronization [CWE-362] when handling shared objects between concurrent threads in the Windows Push Notifications service. The code path lacks atomic operations or sufficient locking primitives to guarantee consistent state during privileged actions. This creates a Time-of-Check Time-of-Use (TOCTOU) condition where a resource validated in one thread can be replaced or modified by another before it is used.
Attack Vector
Exploitation requires local access and low privileges on the target system. The attacker must repeatedly invoke the vulnerable code path while concurrently manipulating the shared resource to win the timing window. Because attack complexity is rated high, reliable exploitation requires precise timing and may need multiple attempts. No user interaction is required once the attacker has authenticated access to the host. Successful exploitation yields SYSTEM-level privileges, enabling installation of persistence mechanisms, credential theft, or lateral movement preparation. Refer to the Microsoft Security Update Guide for CVE-2026-42991 for vendor-specific technical details.
Detection Methods for CVE-2026-42991
Indicators of Compromise
- Unexpected child processes spawned by WpnUserService or WpnService running with SYSTEM privileges.
- Anomalous handle duplication or token manipulation events originating from notification-related service processes.
- Repeated, high-frequency invocations of Push Notification APIs from a single low-privileged user session, suggesting race condition exploitation attempts.
Detection Strategies
- Monitor process creation events where the parent is a Push Notifications service and the child runs in an elevated security context.
- Hunt for abnormal thread injection or handle inheritance patterns targeting WpnUserService and related notification platform binaries.
- Correlate Windows Security event logs for privilege assignment changes following short-lived bursts of notification API activity.
Monitoring Recommendations
- Enable command-line auditing and Sysmon Event ID 1 and 10 to track process creation and process access targeting notification services.
- Forward endpoint telemetry to a centralized analytics platform for behavioral correlation across user sessions.
- Baseline normal Push Notifications service behavior so that anomalous concurrent access patterns become detectable.
How to Mitigate CVE-2026-42991
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-42991 to all affected Windows client and server systems.
- Inventory endpoints running affected builds of Windows 10, Windows 11, and Windows Server, and prioritize patching of multi-user and high-value hosts.
- Restrict local logon rights to trusted users and enforce least privilege to reduce the population of accounts that could trigger the flaw.
Patch Information
Microsoft has released security updates addressing CVE-2026-42991. Patch details, affected build numbers, and update package KB identifiers are published in the Microsoft Security Update Guide. Administrators should deploy the updates through Windows Update, WSUS, Microsoft Intune, or Configuration Manager according to their standard patch management process.
Workarounds
- No official workaround has been published by Microsoft; applying the security update is the supported remediation.
- As a defense-in-depth measure, limit interactive and remote desktop access on sensitive systems to reduce opportunities for local exploitation.
- Monitor and alert on attempts to disable or tamper with the Windows Push Notifications service while patches are being staged.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
