CVE-2026-42836

What it actually does

This is a local privilege-escalation flaw in Windows Function Discovery Service component fdwsd.dll caused by improper synchronization of a shared resource. A low-privileged authenticated user can attempt to win a race condition during concurrent Function Discovery operations so that privileged service logic acts on attacker-influenced state. Successful exploitation can allow elevation from a normal local user context to a higher-privileged context, potentially including SYSTEM-level control, with high confidentiality, integrity, and availability impact. The attack requires local access, prior authentication, and reliable race timing, which raises exploitation complexity.

Why it matters to the business

If exploited, an attacker who has already gained a foothold on a Windows workstation or server could turn limited access into full control of the device, enabling credential theft, security-tool tampering, lateral movement, data access, or deployment of malware. The vulnerability affects many supported Windows client and server versions, so exposure may be broad in mixed enterprise fleets. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has no reported exploit maturity, and has a low/stable EPSS score, but local privilege-escalation bugs are still important because they are commonly chained with phishing, stolen credentials, browser exploits, or remote-code-execution vulnerabilities.

How an attack unfolds

An attacker first obtains local, low-privileged access to an affected Windows system through another technique such as valid credentials, malware execution, remote access abuse, or exploitation of a separate vulnerability. The attacker then runs code that interacts with the Windows Function Discovery Service and attempts to trigger concurrent operations involving fdwsd.dll. By repeatedly manipulating timing and shared resource state, the attacker tries to win the race so the service performs a privileged action using attacker-controlled or attacker-influenced data. If the race succeeds, the attacker gains elevated privileges and can then create privileged processes, dump credentials, disable defenses, install persistence, or move laterally. Because exploitation is local and timing-dependent, successful attacks may involve repeated attempts and may leave limited direct evidence beyond unusual Function Discovery service activity followed by privilege escalation behavior.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no exact fixed build or KB is provided in the input, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch-management tooling to identify and deploy the cumulative update that supersedes the vulnerable fdwsd.dll version. Prioritize systems where untrusted users can log on locally or interactively, shared workstations, VDI hosts, jump boxes, terminal servers, build servers, and internet-facing systems where a separate vulnerability could provide the initial foothold. If immediate patching is not possible, reduce local logon rights, remove unnecessary interactive access, harden endpoint controls, monitor for privilege-escalation behavior, and restrict abuse of administrative utilities. Avoid disabling Function Discovery services broadly unless validated with application and network-discovery requirements, because doing so can affect device discovery, network browsing, and related Windows functionality.

How to confirm the fix worked

Confirm that affected systems have installed the applicable Microsoft cumulative security update released for this issue or a later superseding update. Validate through centralized patch-management compliance reports and by checking Windows build/UBR values or installed hotfix history against Microsoft’s fixed baseline for the affected OS release. On representative systems, verify that %SystemRoot%\System32\fdwsd.dll has a file version at or above the patched version documented by Microsoft for that platform. Confirm that unsupported or out-of-servicing Windows builds are upgraded to supported releases, because they may not receive a complete fix. After remediation, rescan with authenticated vulnerability scanners and ensure the finding is no longer reported. For mitigation-only cases, validate that local interactive logon is restricted, least-privilege controls are enforced, and monitoring detects suspicious privilege escalation from low-privileged accounts.

Typical attack path

1. Gain local authenticated access to an affected Windows endpoint or server as a low-privileged user.
2. Execute a local exploit or custom tool that interacts with Windows Function Discovery components.
3. Trigger repeated concurrent Function Discovery operations to exploit the race condition in fdwsd.dll.
4. Win the race so privileged service logic acts on attacker-influenced state.
5. Spawn or obtain a higher-privileged process or token.
6. Use elevated access to disable controls, harvest credentials, install persistence, access sensitive data, or move laterally.

How to detect it

There are no public exploit-specific indicators or known weaponized campaigns for this issue in the supplied intelligence, so detection should focus on behavioral evidence of local privilege escalation. Review Windows Security logs, Sysmon or EDR telemetry, service-control logs, PowerShell logs, and endpoint process telemetry around suspected compromise windows. Look for a low-privileged account performing unusual Function Discovery-related activity followed closely by elevated process creation, SYSTEM-level command shells, new local administrators, credential-dumping tools, service installation, scheduled task creation, or endpoint-defense tampering. Relevant Windows events include Security 4624/4627 for logon context, 4672 for special privileges assigned, 4688 for process creation if enabled, 4697 for service installation, 4698 for scheduled task creation, 4720/4728/4732 for account or group changes, and System 7036/7040/7045 for service state/configuration/install activity. With Sysmon, review Event ID 1 process creation, 7 image loads involving fdwsd.dll in unusual process contexts, 10 process access to LSASS or privileged processes, 11 file creation, and 12/13/14 registry changes. Pay particular attention to sequences where Function Discovery services or svchost-hosted service activity is followed by a process running as SYSTEM or an administrator that was initiated by a previously low-privileged user. Because fdwsd.dll and Function Discovery services are legitimate Windows components, their presence alone is not evidence of compromise; use correlation with privilege changes and post-exploitation actions.

• %SystemRoot%\System32\fdwsd.dll
• C:\Windows\System32\fdwsd.dll
• Function Discovery Provider Host
• Function Discovery Resource Publication
• fdPHost
• FDResPub
• Event ID 4672
• Event ID 4688
• Event ID 4697
• Event ID 4698
• Event ID 7045
• Sysmon Event ID 1
• Sysmon Event ID 7
• Sysmon Event ID 10

What your security team should do

• Deploy the relevant Microsoft cumulative security update to affected Windows clients and servers, prioritizing systems with interactive users, shared access, administrative workflows, or high-value roles.
• Use authenticated asset inventory to identify all listed Windows versions and separate unsupported or out-of-servicing builds that require upgrade or isolation.
• Treat this primarily as a post-compromise privilege-escalation risk and ensure it is covered in attack-chain prioritization alongside remote-code-execution, credential-theft, and initial-access vulnerabilities.
• Review endpoint detection coverage for local privilege escalation: suspicious token elevation, unexpected SYSTEM shells, new services, scheduled tasks, security-tool tampering, and credential-dumping activity.
• Restrict local logon and remote interactive access to only required users and administrators, especially on servers and privileged-access workstations.
• Hunt for suspicious Function Discovery service activity followed by privileged process creation, persistence creation, or credential access, while recognizing there are no public exploit-specific indicators at this time.
• Maintain rapid rollback-tested patch deployment for Windows cumulative updates, because local elevation vulnerabilities are frequently chained after initial compromise even when standalone EPSS is low.