CVE-2026-42980: Windows Kernel Local Privilege Escalation via WMI Integer Underflow

The Windows Management Instrumentation (WMI) subsystem handles administrative data queries and management infrastructure operations within the Windows NT operating system kernel (ntoskrnl.exe). To facilitate user-mode requests, the kernel exposes the \Device\WMIDataDevice device node, which is accessible to local authenticated users, including those running in low-privilege contexts. When processing queries for WMI instance data, the kernel must collect, package, and serialize the requested structures before transmitting them back to the caller.\n\nThe vulnerability designated as CVE-2026-42980 lies within the memory serialization pathways utilized during multi-instance query operations. Specifically, the serialization loop handles variable-length data objects (WNODE structures) by dynamically computing remaining buffer offsets. If an attacker controls the size parameters of the returned data blocks, they can manipulate the internal capacity calculations of the output buffer.\n\nThis memory corruption vector represents a local privilege escalation (LPE) threat. Successful exploitation allows a local, non-privileged threat actor to bypass system boundaries, overwrite critical kernel structures, and escalate execution privileges to NT AUTHORITY\SYSTEM. The attack requires no user interaction and can be performed programmatically.

The underlying security flaw is an unsigned 32-bit integer underflow (CWE-191) that manifests in the loop-based memory accounting routines. The serialization logic relies on a tracking variable, OutputBufferLength or OutBufferSize, to enforce boundaries during copy operations. As individual serialized records are processed, their respective sizes are aligned to 8-byte boundaries and deducted from this remaining capacity counter.\n\nThe vulnerability occurs because the kernel executes subtraction operations without validating that the minuend is greater than or equal to the subtrahend. Specifically, in nt!WmipQuerySingleMultiple (triggered by IOCTL 0x228130), the subtraction OutBufferSize -= AlignedActualSize is performed without a safety check. When a WMI provider returns a payload where the aligned size exceeds the remaining buffer capacity, an arithmetic wrap occurs.\n\nFor example, if the remaining buffer space is 0x94 bytes and the aligned record size is 0x98 bytes, the subtraction yields a negative result. In an unsigned 32-bit integer context, this result wraps around to 0xFFFFFFFC. Because the kernel interprets this underflowed value as a massive available buffer capacity, subsequent loop validations succeed, permitting out-of-bounds writes into adjacent kernel pool allocations.

The vulnerable implementation handles data alignment and buffer subtraction in a tight loop. Below is the comparative analysis of the vulnerable assembly-derived pseudocode versus the corrected implementation introduced by the vendor.\n\nc\n// Vulnerable Code Path in ntoskrnl.exe\n// IOCTL 0x228130 processing loop\nULONG AlignedActualSize;\nULONG OutBufferSize; // Unsigned 32-bit counter\n\n// ... loop through records ...\nAlignedActualSize = (ReturnedDataSize + 7) & 0xFFFFFFF8;\nTotalRequiredSize += AlignedActualSize;\n\n// BUG: Direct subtraction without verification\nOutBufferSize -= AlignedActualSize; \n\n// Subsequent write using the underflowed size\nmemmove(CurrentWritePointer, ProviderDataBuffer, ReturnedDataSize);\n\n\nThe security update mitigates the vulnerability by modifying the WMI serialization functions to execute a branchless saturating subtraction. This pattern prevents underflows without introducing conditional branches that might be susceptible to speculative execution side-channel exploitation.\n\nc\n// Patched Code Path in ntoskrnl.exe\nULONG AlignedActualSize;\nULONG OutBufferSize;\nULONG TargetDifference;\n\n// ... loop through records ...\nAlignedActualSize = (ReturnedDataSize + 7) & 0xFFFFFFF8;\nTotalRequiredSize += AlignedActualSize;\n\n// FIX: Branchless saturating subtraction\nTargetDifference = OutBufferSize - AlignedActualSize;\nif (Feature_1045423416__private_IsEnabledDeviceUsageNoInline()) {\n // If AlignedActualSize is greater than OutBufferSize, the comparison returns 0.\n // Negating 0 yields 0, setting the entire subtraction result to 0 via bitwise AND.\n TargetDifference = -(ULONG)(AlignedActualSize < OutBufferSize) & TargetDifference;\n}\nOutBufferSize = TargetDifference;\n\n// Copy validation now checks against the clamped zero value\nif (OutBufferSize >= ReturnedDataSize) {\n memmove(CurrentWritePointer, ProviderDataBuffer, ReturnedDataSize);\n} else {\n // Terminate processing and return buffer overflow status\n return STATUS_BUFFER_OVERFLOW;\n}\n\n\nThis structural patch eliminates the underflow vector by guaranteeing that the remaining capacity counter is clamped to zero when an overflow condition is detected. This forces subsequent boundary checks to fail, gracefully aborting the loop.

Exploitation of CVE-2026-42980 requires a calibrated approach to groom the kernel's non-paged pool memory before triggering the integer underflow. The public proof-of-concept leverages Named Pipe File System (npfs.sys) allocations, using the pool tag NpFr, to achieve reliable target positioning. By spraying and freeing specific objects, the exploit constructs a deterministic memory layout.\n\nmermaid\ngraph LR\n A["Spray contiguous NpFr Named Pipes"] --> B["Free selected pipe to create 4KB Hole"]\n B --> C["Allocate WMI SystemBuffer in Hole"]\n C --> D["Trigger Underflow & Overwrite adjacent NpFr header"]\n\n\nThe first phase sprays approximately 4096 named pipe entries of exactly 0xFF0 bytes to establish contiguous allocations in the non-paged kernel pool. Next, the exploit creates an empty slot by releasing one of the named pipes near the end of the allocation chain. The exploit then issues the vulnerable WMI query, forcing the kernel to allocate the WMI SystemBuffer in the newly created hole, directly adjacent to an active NpFr named pipe entry.\n\nBy supplying a custom WMI provider where the alignment rounding logic forces the actual returned size to exceed the estimated capacity, the exploit triggers the underflow during serialization. This allows the subsequent copy operation to overwrite the adjacent NP_DATA_QUEUE_ENTRY structure. The exploit modifies the DataSize field of the named pipe queue entry, inflating it to a high value.\n\nOnce the named pipe metadata is corrupted, the exploit performs a PeekNamedPipe operation to read past the allocated data, leaking critical kernel pointers to user-mode. This leak allows the exploit to dynamically resolve the base address of the current process and the System process. Using a secondary underflow injection, the exploit configures an arbitrary read/write primitive, traverses the ActiveProcessLinks chain, locates the SYSTEM token, and performs a token swap on the target process structure to escalate privileges.

The security impact of successful exploitation is a complete compromise of the local operating system. Because the vulnerability resides within the Windows NT OS Kernel (ntoskrnl.exe), the execution context achieved is Ring 0 (Kernel Mode). This bypasses all user-mode security controls, administrative boundaries, and application sandboxes.\n\nAn attacker with low-privilege execution rights can utilize this exploit to establish persistent administrative access, install low-level rootkits, or disable host-based security agents and endpoint detection and response (EDR) solutions. The vulnerability does not require user interaction, making it attractive for integration into lateral movement and post-exploitation playbooks.\n\nThe CVSS v3.1 base score of 7.8 reflects the high severity of the local privilege escalation threat. While the exploit requires local execution access, the low complexity and lack of administrative prerequisite permissions elevate the overall risk profile, particularly in multi-tenant or shared terminal server environments.

The primary remediation strategy is the immediate installation of the cumulative security updates issued by Microsoft on or after June 9, 2026. These updates apply the corrected branchless saturating subtraction logic to ntoskrnl.exe, rendering the underflow vector inert. Organizations should prioritize updating domain controllers, terminal servers, and high-value developer workstations.\n\nWhere immediate patching is unfeasible, administrators should implement restrictive access policies. Access to the vulnerable \Device\WMIDataDevice node can be restricted by auditing and hardening the access control lists (ACLs) of WMI system drivers. Reducing the privileges of local service accounts and restricting interactive logon rights can minimize the exposed internal attack surface.\n\nTo detect potential exploitation attempts, security operations centers should monitor for abnormal process spawning patterns and rapid named pipe creation events. EDR rules should be configured to flag instances of non-privileged processes executing high-frequency Named Pipe operations (specifically around size parameters of 0xFF0 or contiguous handles) followed by the creation of elevated shells running as NT AUTHORITY\SYSTEM.