G4sp4rCS/CVE-2026-42980-POC

GitHubRepository PoCExploit

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full local privilege escalation exploit for CVE-2026-42980. It uses a WMI integer underflow to achieve an out-of-bounds write, corrupts a named pipe object to gain arbitrary kernel read/write, steals a SYSTEM token, and spawns a SYSTEM shell.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a public proof-of-concept (PoC) for CVE-2026-42980, a Windows kernel WMI integer-underflow vulnerability leading to local privilege escalation. The reviewed source code (cve_2026_42980_lpe.c, Makefile, README.md, README.es.md) implements a standard exploit chain: pool spraying, triggering the underflow to achieve an out-of-bounds write, corrupting a named pipe data structure, and using the resulting read/write primitives to steal a SYSTEM token and spawn a privileged shell. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed remote access was observed. The code performs only the actions necessary for the described local privilege escalation exploit.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesCMakefileMarkdown
Target softwareMicrosoft Windows NT OS KernelWMI (Windows Management Instrumentation)
Attack typeslocal privilege escalationinteger underflowheap-based buffer overflowarbitrary kernel read/writetoken theft
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary C source file (cve_2026_42980_lpe.c) contains a complete, multi-stage exploit that triggers a kernel vulnerability, corrupts memory, achieves arbitrary read/write, steals a SYSTEM token, and spawns a SYSTEM shell. The README files describe it as a 'PoC' for local privilege escalation to SYSTEM. This is exploit code, not a scanner or a writeup.

src/cve_2026_42980_lpe.c:1-1289README.md:3

Requirements

  • Requires local low-privilege code execution on a vulnerable Windows build.src/cve_2026_42980_lpe.c:1-1289
  • Requires a specific WMI GUID instance with non-8-aligned size to trigger the integer underflow.src/cve_2026_42980_lpe.c:534-637

Observed behavior

  • Opens the WMIDataDevice and resolves a WMI GUID instance with exploitable 'slop'.src/cve_2026_42980_lpe.c:367-424src/cve_2026_42980_lpe.c:534-637
  • Sprays the non-paged pool with named pipe objects and creates a hole for the vulnerable buffer.src/cve_2026_42980_lpe.c:1039-1089
  • Sends a crafted IOCTL_WMI_QUERY_SINGLE_MULTIPLE request to trigger an integer underflow, causing an out-of-bounds write that corrupts an adjacent named pipe object.src/cve_2026_42980_lpe.c:867-934src/cve_2026_42980_lpe.c:1112-1124
  • Leaks kernel pool metadata (flink/blink) from the corrupted pipe to establish an arbitrary read primitive.src/cve_2026_42980_lpe.c:1132-1192
  • Uses the arbitrary read to locate the current process EPROCESS and the SYSTEM process EPROCESS and token.src/cve_2026_42980_lpe.c:1197-1257
  • Uses an arbitrary write primitive to overwrite the current process's token with the SYSTEM token.src/cve_2026_42980_lpe.c:1262-1271
  • Spawns a new cmd.exe process, which inherits the stolen SYSTEM token, resulting in a SYSTEM shell.src/cve_2026_42980_lpe.c:337-350src/cve_2026_42980_lpe.c:1281-1282
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique
Kernel pool corruption via WMI integer underflow leading to token theftThe PoC uses a well-known local privilege escalation pattern: trigger a kernel bug to corrupt adjacent pool memory, abuse a corrupted named pipe to gain arbitrary read/write, locate the SYSTEM process token, and overwrite the current process token.src/cve_2026_42980_lpe.c:1-1289
Target Behavior
Spawns cmd.exe with SYSTEM privilegesThe final phase of the exploit calls spawn_system(), which creates a new cmd.exe process. This is the expected outcome of a local privilege escalation PoC.src/cve_2026_42980_lpe.c:337-350src/cve_2026_42980_lpe.c:1281-1282
Review boundaries

What the analysis did not establish

  • Evidence does not include the content of the included helper files (helpers.c, wmi_guids.h) or the build script (build.ps1), which are necessary for compilation and contain critical definitions (e.g., WMI GUIDs, CheckVersion, CreateSprayPipe, WriteDataEntry, ReadDataEntry, PsGetProcessFromPid, readQWORD).
  • Evidence does not include the content of the writeup files (writeup-en.md, writeup-es.md) referenced in the README.
  • The evidence includes a non-text media file (photo-poc-system.jpg) that was not analyzed.
  • The analysis is based solely on the provided source code and documentation; the exploit was not executed or verified.
  • The compiled binary (poc.exe) and non-text media files (e.g., assets/photo-poc-system.jpg) were not analyzed; only the provided source code was reviewed.
  • Five additional text files (writeup-en.md, writeup-es.md, build.ps1, helpers.c, wmi_guids.h) are listed in the repository layout but their content was not included in the evidence packet, so their behavior could not be verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1