PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-42980 PoC: Windows kernel WMI integer underflow local privilege escalation

github.com | vulnerability | High | CVE-2026-42980 | #public-poc | #kernel-security | #privilege-escalation | #windows-security | #windows | #wmi | #integer-underflow | #cwe-122 | #cwe-191 | #vulnerability | #poc | #windows-kernel | #cve-2026-42980
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Disclosure repo for CVE-2026-42980: a Windows kernel WMI integer underflow exploited for local privilege escalation to NT AUTHORITY\SYSTEM, with C sources, build scripts and bilingual write-ups.

Why it matters

The public code turns a Windows kernel integer underflow into local escalation from a normal user to SYSTEM, making it relevant to authorized kernel research and patch validation. Reproduction should be limited to owned, isolated, recoverable systems, and Microsoft fixes should be applied promptly.
CVE
CVE-2026-42980
Vendor
Microsoft
Product
Windows NT OS Kernel / WMI
Affected versions
Microsoft Windows builds affected by the Windows NT OS Kernel WMI integer-underflow vulnerability; consult Microsoft security updates for fixed build details
CVSS
7.8
Published
Collected

Related coverage

High · vulnerability · github.com
GOG Galaxy Local Privilege Escalation (LPE) PoC via DLL Search-Order Hijacking
Demonstrates persistent DLL hijacking vulnerabilities in popular gaming clients, showing how insecure service configurations and missing safe DLL search controls allow standard users to breach SYSTEM privilege boundaries.
High · vulnerability · github.com
CVE-2026-66804 PoC: Windows Cross Device virtual camera local privilege escalation to SYSTEM
The PoC demonstrates a complete local privilege-escalation chain from a standard user to SYSTEM, and exploit code is now public. Affected Windows endpoints should install Microsoft's August 2026 security updates promptly. Reproduction plants a DLL in a system path and triggers a privileged service, so it should only be performed in an explicitly authorized, recoverable lab environment.
High · vulnerability · github.com
CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation
The PoC turns a kernel UAF into local privilege escalation from an ordinary user to root, making it relevant for authorized Linux kernel research and patch validation. The race can panic or corrupt a system, so it should only run in an isolated, recoverable lab VM and affected kernels should be updated.
High · vulnerability · github.com
CVE-2026-50656 PoC: Microsoft Defender RoguePlanet elevation-of-privilege patch bypass
The repository publishes a patch-bypass implementation for a Defender elevation-of-privilege flaw, increasing practical risk to affected endpoints. Administrators should update the Malware Protection Engine to a fixed version and validate the PoC only in an explicitly authorized isolated environment; public availability does not by itself confirm exploitation in the wild.
High · vulnerability · bugcrowd.com
What we know about Copy Fail (CVE-2026-31431)
Copy Fail (CVE-2026-31431) is a Linux kernel LPE zero-day since 2017: an algif_aead logic flaw grants root and container escape; a public 732-byte exploit was found by AI in an hour.
High · vulnerability · nebusec.ai
IonStack part III: Rooting Android 17 with GhostLock
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world's first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.
Back