CVE-2026-42979

HighCVSS 7.8/10Last modified Jul 23, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.8880
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.7417
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.7417
MicrosoftWindows 11 version 23H2>= 10.0.22631.0, < 10.0.22631.7219
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.7219
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.8655
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.8655
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.2269
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.8880
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.8880
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.5256
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.32995
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.32995

References

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-42984.3The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is dueCVE-2026-429807.8Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-429818.1Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.CVE-2026-429827.8Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-429837.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-429847.0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-429858.8Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-429867.8Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2026-429878.1Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.CVE-2026-429897.8Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.CVE-2026-42995.3The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due CVE-2026-429909.8Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.
CVE-2026-42979: High severity, CVSS 7.8 | Vulnix