---
id: 6606
title: "CVE-2026-42980 PoC: Windows kernel WMI integer underflow local privilege escalation"
cve: CVE-2026-42980
cvss: 7.8
severity: high
vendor: "Microsoft"
product: "Windows NT OS Kernel / WMI"
affected_versions: "Microsoft Windows builds affected by the Windows NT OS Kernel WMI integer-underflow vulnerability; consult Microsoft security updates for fixed build details"
source_domain: github.com
source_url: "https://github.com/G4sp4rCS/CVE-2026-42980-POC"
published_at: "2026-07-07T03:52:26Z"
tags: ["public-poc", "kernel-security", "privilege-escalation", "windows-security", "windows", "wmi", "integer-underflow", "cwe-122", "cwe-191", "vulnerability", "poc", "windows-kernel", "cve-2026-42980"]
phying_url: "https://phying.com/item/6606"
lang: en
---

# CVE-2026-42980 PoC: Windows kernel WMI integer underflow local privilege escalation

## Summary

Disclosure repo for CVE-2026-42980: a Windows kernel WMI integer underflow exploited for local privilege escalation to NT AUTHORITY\SYSTEM, with C sources, build scripts and bilingual write-ups.

## Why it matters

The public code turns a Windows kernel integer underflow into local escalation from a normal user to SYSTEM, making it relevant to authorized kernel research and patch validation. Reproduction should be limited to owned, isolated, recoverable systems, and Microsoft fixes should be applied promptly.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-42980
- **CVSS:** 7.8
- **Vendor:** Microsoft
- **Product:** Windows NT OS Kernel / WMI
- **Affected versions:** Microsoft Windows builds affected by the Windows NT OS Kernel WMI integer-underflow vulnerability; consult Microsoft security updates for fixed build details
- **Published:** 2026-07-07T03:52:26Z
- **Original:** https://github.com/G4sp4rCS/CVE-2026-42980-POC
- **Phying News:** https://phying.com/item/6606