CVE-2026-42836

HighCVSS 7.0/10Last modified Jul 23, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-428377.8Out-of-bounds read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-428385.4Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allowsCVE-2026-428394.8An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or imagCVE-2026-42844.7A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function dowCVE-2026-428405.1An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rCVE-2026-428414.8Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaSCVE-2026-428425.4The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists CVE-2026-428438.8Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and syCVE-2026-428448.8Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueCVE-2026-428457.7The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via fCVE-2026-428469.8ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticCVE-2026-428477.1ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in Cli
CVE-2026-42836: High severity, CVSS 7.0 | Vulnix