SyntaxMethod/CVE-2026-42978-PoC-Research: cVE-2026-42978Windows Push Notifications Module for AI Security

Next-Gen AI Security Ecosystem, Multi-Protocol Terminal & Autonomous Agent Suite

Website · Product docs · Host application · Community chat

Website navigation: Home · Updates · Downloads · Modules

Official host application

Product: AI Security Tool Site: zerodayevil.github.io Docs: https://zerodayevil.github.io/ai-security-tool

This module is a reviewed write-up and a safe check profile for AI Security Tool. Use only modules listed on the project site or in the official catalog. Load this module inside the approved application, against endpoints you own or are written-authorized to assess.

This repository does not ship a weaponized exploit against WpnService. The lab under lab/ is a standalone mock of the class of bug (TOCTOU / double-fetch). It does not talk to the real push-notification service.

Quick start & installation

Install the host application first. Then enable this module from Modules → Windows / Local EoP → CVE-2026-42978.

Ready-to-use builds

Official sources only:

• https://zerodayevil.github.io/
• https://zerodayevil.github.io/ai-security-tool
• https://github.com/ZeroDayEvil/ai-security-tool

Conceptual overview

CVE-2026-42978 is a local elevation of privilege in Windows Push Notifications. Microsoft describes concurrent access to a shared resource without proper synchronization (CWE-362). Research on patched vs. unpatched wpncore.dll shows a use-after-free race in PresentationEndpointFacade during platform shutdown.

WpnService runs in session 0 as NT AUTHORITY\SYSTEM (svchost.exe -k netsvcs -p). Toast, tile and badge delivery go through it. A won race against that process is a SYSTEM problem on the local machine — not a remote pre-auth DC bug.

Status: patched on 10 June 2026 (Patch Tuesday). This page is defensive research.

It is not CVE-2026-41089 (Netlogon RCE). Different component, different privilege model, different patch date.

Specifications

Scope

Client and server SKUs that ship Push Notifications. Confirm the exact KB on MSRC before you close a ticket.

Orientation builds from public servicing notes (always re-check MSRC):

Root cause (research)

The facade wraps notification API calls and delegates to PresentationEndpointImpl. During platform shutdown the NotificationPlatform object is destroyed. Several facade methods historically took a platform pointer without a shutdown flag or a shared lock. If teardown wins the race, the next call uses a dangling pointer.

Same lock-and-guard pattern was applied across 49 PresentationEndpointFacade::* methods. Implementation methods underneath were left as-is — the hole sat at the facade.

Unpatched shape (wpncore.dll 26100.8521)

// PresentationEndpointFacade::ToastUnblockAll — unpatched
long ToastUnblockAll(PresentationEndpointFacade *this) {
    NotificationPlatformHandle::Get(this + 0x50);
    if (platform == NULL)
        Throw_Hr(...);
    return PresentationEndpointImpl::UnblockToastsForEachApp(...);
}

Patched shape (wpncore.dll 26100.8655)

// PresentationEndpointFacade::ToastUnblockAll — patched
long ToastUnblockAll(PresentationEndpointFacade *this) {
    if (Feature_4097557817::IsEnabled()) {
        AcquireSRWLockShared(&Wns::s_platformLock);
        if (Wns::s_platformShutdown)
            Throw_Hr(E_APPLICATION_EXITING);
        NotificationPlatformHandle::Get(this + 0x50);
        ReleaseSRWLockShared(&Wns::s_platformLock);
    }
}

What the patch adds:

1. AcquireSRWLockShared — readers-writer lock; shutdown takes exclusive.
2. s_platformShutdown — bail with E_APPLICATION_EXITING if teardown started.
3. RAII release via WIL unique_storage, so the lock drops on exception paths.
4. Feature flag Feature_4097557817 for staged rollout / rollback.

Scale of the binary diff

PE notes from reports/:

• .text grew by 18,432 bytes
• .data grew by 96 bytes (Wns::s_platformLock, Wns::s_platformShutdown)
• no new imports — SRW lock APIs were already present
• new RAII destructor for exclusive lock release

Impact

WpnService is SYSTEM. If the race is won, a dangling vtable call can be turned into local SYSTEM code execution. That step — heap spray, vtable hijack, payload — is out of scope here.

This module is for root-cause literacy, patch verification, and detection.

Using this module inside AI Security Tool

1. Install a current official build from zerodayevil.github.io.
2. Open Modules → CVE-2026-42978.
3. Point the check at authorized Windows endpoints.
4. Treat the result as patch presence / WPN posture, not “fire the race”.
5. Optionally collect the detection pack (detection/) onto a lab box.

Do not run crash or race loops against production WpnService.

authorized operator
        │
        ▼
 AI Security Tool  →  module 42978
        │
        ▼
 authorized Windows endpoint
        │
        ├─ patch / wpncore.dll age
        └─ SIEM / Sysmon / Event Log notes

TOCTOU lab (mock service only)

lab/ is a standalone C demo of double-fetch / TOCTOU. It uses a named pipe and shared memory. It does not load wpncore.dll and does not start or stop WpnService.

• vulnerable_service.exe — validates a length, sleeps, reads the length again.
• race_attacker.exe — flips the shared value during that window.
• --patched — single-fetch into a local variable; the same attacker should see zero races.

Requires GCC (MinGW). From lab/:

build.bat

Terminal 1: vulnerable_service.exe Terminal 2: race_attacker.exe 5 Then compare with vulnerable_service.exe --patched.

Detection and threat hunting

ETW monitor — detection/etw_wpn_monitor.ps1

Seven checks:

1. WpnService state and PID
2. Crash / restart history
3. Push Notifications Platform event-log burst
4. WPN-related named pipes
5. Patch hint (wpncore.dll date / build)
6. Processes with WPN modules loaded
7. Junction / symlink audit under notification data paths

powershell -ExecutionPolicy Bypass .\detection\etw_wpn_monitor.ps1

Sysmon — detection/sysmon_wpn_race_detect.xml

sysmon64.exe -accepteula -i detection\sysmon_wpn_race_detect.xml

Event Viewer

Channel: Microsoft-Windows-PushNotifications-Platform/Operational

• Event 1225 — transport-level WPN commands
• Burst rate (for example >20/min) — worth a look, not a conviction
• Error / Critical — possible crash from a failed attempt

Mitigation checklist

• June 2026 cumulative update on every in-scope SKU
• wpncore.dll build matches the patched row for that branch
• EDR / Sysmon on workstations and jump boxes, not only DCs
• Alert on svchost -k netsvcs spawning a shell
• Host-app module result archived with the hotfix inventory

If etw_wpn_monitor.ps1 says unpatched — install the June 2026 update and re-check.

Related CVEs (June 2026 WPN cluster)

Repository layout

CVE-2026-42978/
├── README.md
├── LICENSE
├── lab/
│   ├── vulnerable_service.c
│   ├── race_attacker.c
│   └── build.bat
├── detection/
│   ├── etw_wpn_monitor.ps1
│   └── sysmon_wpn_race_detect.xml
└── reports/
    ├── PE_DIFF_REPORT.txt
    └── FUNCTION_DIFF_REPORT.txt

Needs: Windows 10/11 for detection scripts · MinGW for the mock lab · Sysmon optional.

Screenshots in this README are loaded from public image URLs. They are not stored in this tree.

References

• MSRC — CVE-2026-42978
• CVE record
• BDU:2026-08249

Security modules catalog

Contribution & community

Useful work:

1. Facts — MSRC builds, sibling CVEs in the June WPN cluster.
2. Detection — Sigma, better ETW, ASR recommendations.
3. Host-app metadata and translations.
4. Docs and broken-link fixes.

Do not open a PR that adds a weaponized WpnService exploit, heap-spray helper, or exploit PoC against the live service.

Contact & support

• Website: zerodayevil.github.io
• Product docs: zerodayevil.github.io/ai-security-tool
• Telegram admin: @ZeroDayEvil
• Telegram chat: @ZeroDyaTool_chat
• Telegram channel: @ZeroDyaTool_channel
• Open Collective: opencollective.com/ZeroDayEvil