CVE-2026-42836: Windows Function Discovery Service Race Condition Privilege Escalation

Technical summary

CVE-2026-42836 is a local privilege escalation vulnerability stemming from improper synchronization of shared resources in fdwsd.dll (Function Discovery Service). The race condition (CWE-362) combined with potential use-after-free patterns (CWE-416) allows an authenticated local attacker to achieve privilege elevation. The attack requires low-level user privileges (PR:L) and a non-trivial race window (AC:H), but once triggered, it grants high-impact access to confidentiality, integrity, and availability controls. The vulnerability is not limited to a single Windows version and affects multiple release channels across Windows 10, Windows 11, and Windows Server editions.

Business impact

This vulnerability creates a post-compromise risk for any organization running affected Windows systems. An insider or attacker who has gained user-level access—whether through phishing, weak credentials, or another vector—can use this flaw to gain administrative control without requiring external resources or elevated entry points. On endpoints used by privileged staff (system administrators, developers, database administrators), this escalation could lead to lateral movement, data exfiltration, or persistence mechanisms. On shared servers or terminal services, the risk is amplified. Given the broad OS coverage, remediation delay could expose a significant portion of most enterprise Windows fleets.

Affected systems

The vulnerability impacts Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server editions (2012, 2016, 2019, 2022, 2025). Organizations should conduct an inventory to identify machines running these versions, particularly those with user populations requiring privilege elevation or those connected to sensitive network segments. Server environments running Windows Server 2012 and 2016 (extended support only) warrant priority attention if still in use.

Exploitability

Exploitation requires authenticated local access and successful execution of a race condition, placing this in the 'difficult but achievable' category for an attacker already on a system. The attack surface is limited to users with local logon rights; remote exploitation is not possible. However, the barrier to entry is significantly lower than remote code execution vulnerabilities, and the complexity is manageable for skilled attackers once they understand the precise timing and resource contention window. No public exploit code or widespread in-the-wild abuse has been reported as of the vulnerability's publication, but the HIGH CVSS score reflects the severity of impact if exploited.

Remediation

Patched versions of Windows must be deployed to all affected systems. Verify the specific build numbers and cumulative update versions from Microsoft's June 2026 security bulletin before deployment. Organizations should prioritize servers, high-value endpoints, and machines used by administrative staff. In environments where patching must be phased, implement complementary mitigations: enforce strict access controls restricting local logon to necessity-based groups, monitor process creation and privilege escalation events, and disable Function Discovery Service where not required for business operations. Test patches in a controlled environment before broad rollout, particularly on Windows Server 2012 systems where extended support timelines may affect your patch schedules.

Patch guidance

Obtain and deploy the cumulative updates or security-only patches released in June 2026 from Microsoft Update, Windows Server Update Services (WSUS), or Microsoft's catalog. Verify patch status via 'winver' or 'systeminfo' post-deployment. For Windows Server systems, prioritize machines in Data Center and Standard editions currently in support. Windows Server 2012 (including R2) requires particular attention due to its extended support lifecycle—confirm patch availability and compatibility with your infrastructure before scheduling. If using endpoint management systems (Intune, SCCM, Configuration Manager), configure automatic deployment policies and monitor compliance. Test in a staging environment reflecting your production configuration before broad deployment to catch any compatibility issues with line-of-business applications.

Detection guidance

Monitor Event Viewer logs for suspicious privilege escalation attempts, particularly in Security event ID 4672 (Special privileges assigned to new logon) and 4673 (An attempt was made to call a privileged service operation). Enable audit policies for process creation (Event ID 4688) and object access to catch attempts to manipulate Function Discovery Service resources. Use behavioral analytics to identify unusual patterns of local user elevation or rapid successive failed logon attempts followed by privilege escalation. Check for unsigned or unexpected modifications to fdwsd.dll and related service binaries. Endpoint Detection and Response (EDR) tools should flag attempts to disable or manipulate Windows services associated with Function Discovery. Log and alert on any service restarts or resource contention patterns in the Function Discovery namespace.

Why prioritize this

Despite not being exploited in the wild as a known exploit, this vulnerability merits HIGH priority due to its local privilege escalation impact, broad operating system coverage, and low authentication barrier. Organizations with hybrid or on-premises Windows Server infrastructure face particular risk. The race condition nature means reliable detection is challenging and exploitation windows are narrow—favoring rapid patching over prolonged monitoring. Any system where standard users have local logon rights should be treated as a critical exposure vector for privilege escalation chains.

Risk score, explained

The CVSS 3.1 score of 7.0 (HIGH) reflects a local attack vector with high impact across confidentiality, integrity, and availability, tempered by the requirement for low-level privileges and a difficult-to-trigger race condition (AC:H). The privilege escalation from user to system level is significant, but the difficulty in reliably triggering the race keeps it below CRITICAL. Organizations should not interpret 'merely HIGH' as low urgency—the combination of breadth (15+ OS versions) and impact (full system compromise) justifies immediate patching schedules.

Frequently asked questions