Counting Below Zero: Integer Underflow to SYSTEM in the Windows NT Kernel (CVE-2026-42980)
Vulnerability Overview
CVE-2026-42980 is an elevation of privilege vulnerability in the Windows NT OS Kernel, fixed in Microsoft's June 2026 Patch Tuesday. An integer underflow (wrap or wraparound) in the kernel allows a locally authenticated attacker to corrupt kernel memory and escalate to NT AUTHORITY\SYSTEM. Microsoft rates it Important with a CVSS 3.1 base score of 7.8, and, more consequentially for defenders, labels it "Exploitation More Likely." There is no known in-the-wild exploitation or public exploit code at the time of writing, and it is not listed in the CISA KEV catalog.
This is not a remote break-in; the attacker needs code execution on the box already. It is the second half of an intrusion, the step that converts a phished user or a compromised low-privilege service into total control of the machine. Deploy the June 2026 updates on your normal urgent-patch cadence.
Why a Local EoP Still Matters
Elevation of privilege bugs get less attention than pre-auth RCE, and that is a mistake. Modern intrusions are chains: initial access from phishing, a malicious document, a stolen credential, or a compromised application, followed by escalation. A reliable local EoP is the piece that turns a limited foothold into ownership of the host, and the kernel is the most valuable place to win it, because SYSTEM-level code sitting below user mode can disable security tooling, tamper with EDR, harvest credentials from memory, install persistent drivers, and stage lateral movement. The CVSS vector reflects that ceiling with high confidentiality, integrity, and availability impact, even though the attack vector is local.
Microsoft's "Exploitation More Likely" label is the detail worth acting on. It reflects Microsoft's judgment that the bug class, the reliability of the primitive, and attacker interest make working exploit code a realistic near-term prospect. Kernel EoP flaws in this category have a long track record of being folded into commodity toolkits and ransomware playbooks after patch release, precisely because attackers can diff the patch to find the flaw.
Technical Analysis
The flaw is classified as CWE-191 (Integer Underflow) with an associated CWE-122 (Heap-based Buffer Overflow), and that pairing tells you the shape of the bug. An integer underflow happens when an arithmetic operation drops below the minimum value the type can represent and wraps around to a very large number. In kernel code, this most often bites in size or length calculations: subtracting a header length from an attacker-influenced buffer size, for example, where a value smaller than expected causes the subtraction to wrap to an enormous unsigned value.
That bogus size then propagates into a memory operation. A subsequent allocation or copy trusts the wrapped length, producing a heap-based buffer overflow that writes past the intended bounds of a kernel pool allocation, which is the CWE-122 half of the classification. Corrupting adjacent kernel heap structures is a well-understood road to privilege escalation: an attacker grooms the pool, overwrites a neighboring object's fields or function pointers, and converts that controlled corruption into an arbitrary read/write primitive, ultimately rewriting their own process token to hold SYSTEM privileges.
Microsoft has not published the specific vulnerable code path, which is standard practice for kernel issues while patches roll out. Some third-party trackers associate the flaw with the kernel's memory-management code in the Windows Management Instrumentation (WMI) subsystem, but that attribution has not been confirmed by Microsoft and should be treated as unverified. The exploitability metrics are consistent across sources: local attack vector, low complexity, low privileges required, and no user interaction beyond already having a session on the machine.
Affected Platforms
As a flaw in the NT OS Kernel, this affects a broad sweep of supported Windows client and server releases. Reported affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server releases including Server 2012. Because kernel updates are cumulative and the exact affected build list is long, confirm your specific SKUs and build numbers against the MSRC entry rather than relying on a summary.
| Item | Detail |
|---|---|
| Release date | June 9, 2026 (Patch Tuesday) |
| Max severity | Important |
| Impact | Elevation of Privilege |
| Vector string | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Resolution | Apply the June 2026 cumulative update for your platform |
Mitigation & Remediation
- Apply the June 2026 cumulative update. There is no configuration workaround for a kernel memory-corruption bug. Patching is the fix, and the update is cumulative, so it also closes the other kernel and DWM escalation flaws shipped in the same release.
- Prioritize by exposure, not just by score. A 7.8 local EoP deserves faster treatment than the number suggests on multi-user systems, terminal and RDS servers, jump boxes, developer workstations, and anywhere untrusted users or internet-facing services already execute code.
- Reduce the value of the foothold. Enforce least privilege, keep users out of local administrator groups, segment high-value hosts, and ensure application allowlisting so that an attacker's initial code execution is harder to obtain in the first place.
- Monitor for escalation behavior. Watch for unexpected SYSTEM-level processes, token manipulation, new driver or service installation, and EDR tampering, since those are the observable outcomes of a successful kernel escalation even when the exploit itself is invisible.
The Bigger Picture
CVE-2026-42980 landed in a June 2026 Patch Tuesday that included multiple escalation flaws rated more likely to be exploited, alongside publicly disclosed issues elsewhere in the platform. That pattern is the normal rhythm of Windows security now: a steady supply of local privilege escalation bugs in kernel-adjacent components, any one of which is enough to complete an attack chain that started somewhere far less exotic. Integer underflow in particular remains stubbornly common in large C and C++ codebases, because the unsafe arithmetic looks perfectly reasonable in isolation and only becomes dangerous when an attacker controls one of the inputs. For defenders the response is unglamorous and effective: patch on schedule, assume the initial foothold will eventually happen, and design so that owning one user account does not mean owning the machine.
){kind=link}