CVE-2026-42980

CVE-2026-42980 is a Windows NT kernel integer underflow affecting Windows 10 version 1607 (the 2016 Anniversary Update). The CVSS 7.8 rating reflects a local privilege escalation, but the 'authorized attacker' language in Microsoft's description warrants scrutiny before accepting that score at face value. If 'authorized' means a standard user account, this is a direct horizontal-to-vertical privilege escalation. If it means a service account or already-elevated context, this becomes a post-exploitation mechanism — fundamentally different risk calculus. The 1607 targeting is the detail that should worry you most. Microsoft is backporting a kernel fix to a build that exited mainstream support in 2019. Either this code path was removed during later refactoring, or it still exists in shared subsystems that newer versions haven't fully deprecated. Either answer is significant. The EPSS score of 0.06949 is elevated enough to treat this as operationally relevant — this isn't background noise, and the score suggests active interest from threat actors. What makes this CVE strategically important is not the underflow itself but what it represents. An integer underflow in the NT kernel is a reliable primitive for engine development — threat actors don't need this specific flaw to be novel, they need it to be reproducible across subsystems using similar code patterns. If this code path survived from 2016 unpatched, it suggests abandoned code living in shared kernel components that current development never exercised. That pattern produces predictable, low-variance primitives — exactly what criminal tooling shops and nation-state actors invest in. For defenders: treat this as a kernel LPE with full system compromise potential regardless of what 'authorized' means operationally. Prioritize patching any remaining 1607 deployments urgently. The real question isn't whether this specific CVE is being exploited — it's what other code in that abandoned subsystem is waiting to be found. If Microsoft is auditing this area, more CVEs from the same code family will surface in the next six months.