CVE-2026-42984

What it actually does

This is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Kernel. A low-privileged, authenticated local attacker can trigger unsafe reuse of freed kernel memory and, if they can reliably shape kernel memory, execute code or manipulate kernel objects with elevated privileges. Successful exploitation can allow escalation to SYSTEM or kernel-level control, enabling full confidentiality, integrity, and availability impact on the affected Windows host. The CVSS score is 7.0 with local attack vector, low privileges required, no user interaction, and high impact across confidentiality, integrity, and availability; the high attack complexity indicates exploitation likely requires precise timing, memory grooming, or a separate foothold.

Why it matters to the business

If exploited, an attacker who already has limited access to a Windows workstation or server could gain full administrative control of that system. This can turn an initial compromise, phishing foothold, malicious insider action, or compromised low-privileged account into full host takeover, credential theft, security-tool tampering, lateral movement, data theft, or ransomware deployment. Affected platforms include widely deployed Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 versions, so exposure may be broad across enterprise endpoint and server fleets. It is not currently listed in CISA KEV, is not reported as ransomware-used, has low EPSS probability at 0.00251 with no 30-day increase, and has no known public exploit maturity in the supplied data; however, kernel elevation flaws are frequently chained after initial access and should still be remediated through standard patch cycles, with faster action for high-value servers, administrator workstations, and internet-facing systems where local code execution could be obtained through another vulnerability.

How an attack unfolds

An attacker must first obtain the ability to run code locally as an authenticated, low-privileged user on an affected Windows system. This initial access may come from phishing, malware execution, abuse of a weak account, exploitation of a separate remote-code-execution issue, or interactive access to a shared system. The attacker then runs a purpose-built exploit that interacts with the vulnerable Windows Kernel code path and triggers a use-after-free condition. By manipulating memory allocation patterns, the exploit attempts to reclaim the freed kernel memory with attacker-controlled data and redirect kernel behavior. If successful, the attacker modifies privileged kernel data structures or obtains execution in a privileged context, resulting in SYSTEM-level or equivalent control. From there, they can disable defenses, dump credentials, install persistence, access protected files, pivot to other hosts, or stage additional payloads. Because attack complexity is high and no mature exploit is indicated, exploitation is less likely to be opportunistic at present, but remains valuable as a post-compromise privilege-escalation step.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-42984 for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. No exact fixed build numbers or KB identifiers were provided in the input, so administrators should verify against the official Microsoft Security Update Guide and install the cumulative update released on or after the publication date, 2026-06-09, for each supported OS version. Prioritize patching systems where low-privileged users can log on, systems used by administrators, jump hosts, domain administration workstations, virtualization hosts, file servers, remote desktop hosts, and systems that may be exposed to untrusted code execution paths. If immediate patching is not possible, reduce risk by enforcing least privilege, limiting interactive logon rights, restricting local administrator group membership, blocking untrusted executable content, hardening application control policies, ensuring endpoint detection is active, and monitoring for privilege escalation behavior. Because this is a kernel flaw, configuration-only mitigations should be treated as compensating controls rather than a substitute for patching.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows asset has installed the applicable cumulative security update from Microsoft that includes the fix for this vulnerability. Use enterprise patch-management, vulnerability-scanning, and endpoint-management tools to compare OS version, build number, and installed update history against Microsoft’s official fixed release information. Validate coverage across both client and server versions listed as affected, including offline, intermittently connected, and golden-image systems. After patching, run an authenticated vulnerability scan or compliance query to ensure the system no longer reports exposure. Where possible, verify that baseline images, VDI templates, server templates, and recovery images are also updated so the flaw is not reintroduced during rebuilds. For mitigation validation, confirm that non-administrative users cannot write to sensitive directories, cannot disable endpoint controls, and do not have unnecessary interactive logon rights on high-value systems.

Typical attack path

1. Gain low-privileged authenticated access to an affected Windows workstation or server.
2. Transfer or stage a local privilege-escalation exploit on the host, or execute it from an existing malware implant.
3. Trigger the vulnerable Windows Kernel code path that mishandles freed memory.
4. Use memory grooming or timing techniques to reclaim freed kernel memory with attacker-influenced content.
5. Manipulate kernel objects, access tokens, or execution flow to elevate from a standard user context to SYSTEM or equivalent privileges.
6. Use elevated privileges to disable security controls, dump credentials, access sensitive data, establish persistence, or move laterally.

How to detect it

Detecting confirmed exploitation of a Windows Kernel use-after-free privilege-escalation vulnerability is difficult because successful exploitation may not create a unique application log entry or file artifact. Focus on evidence of post-exploitation behavior occurring after a low-privileged process unexpectedly gains SYSTEM-level privileges. Useful telemetry sources include EDR process trees, Windows Security logs, Sysmon logs, PowerShell logs, Windows Defender or other endpoint protection alerts, crash dumps, Windows Error Reporting data, and authentication logs. Look for unusual parent-child process relationships where user-writable or temporary-location executables spawn SYSTEM shells or administrative tools; unexpected token privilege changes; new services or scheduled tasks created shortly after execution from a user profile; LSASS access attempts; security control tampering; suspicious driver loading; abnormal kernel crashes or bugchecks preceding privilege changes; and local administrator group modifications. Correlate suspicious local execution with follow-on credential dumping, lateral movement, persistence creation, or defense evasion. No named threat actors, campaign-specific artifacts, public exploit signatures, or ransomware usage were provided, so detection should be behavior-based rather than IOC-only.

What your security team should do

• Inventory all Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems and identify those running affected versions.
• Patch high-value and high-risk systems first, especially administrator workstations, jump boxes, domain management systems, remote desktop servers, and servers allowing broad user logon.
• Track Microsoft Security Update Guide entries for the exact cumulative update or fixed build because no fixed versions were provided in the input.
• Run authenticated vulnerability scans after patch deployment to confirm the issue is no longer detected.
• Review endpoint telemetry for recent suspicious privilege escalation, unexpected SYSTEM processes, credential dumping attempts, security-tool tampering, and new persistence mechanisms.
• Restrict local code execution opportunities using application control, script control, least privilege, and removal of unnecessary interactive logon permissions.
• Monitor for exploit development even though EPSS is currently low, the 30-day trend is flat, it is not in KEV, and no public exploit maturity is reported.
• Ensure incident response playbooks treat this as a post-compromise escalation risk that may be chained with phishing, malware, or remote-code-execution vulnerabilities.