Windows Push Notification Service Use-After-Free Race (CVE-2026-42978)

Metadata

Affected Target

Summary

CVE-2026-42978 is a use-after-free race condition (CWE-362) in wpncore.dll’s PresentationEndpointFacade class, which backs the WpnService Windows Push Notification service running as NT AUTHORITY\SYSTEM. Facade methods (e.g. ToastUnblockAll) fetch a pointer to the NotificationPlatform object without checking whether platform shutdown is in progress or holding any lock; if the shutdown thread frees the platform between the pointer fetch and its use, a dangling pointer is dereferenced from SYSTEM context. This repository documents the root cause via decompiled vulnerable/patched code comparison, includes a standalone (non-WpnService) C lab that reproduces the general double-fetch/TOCTOU pattern, and ships ETW/Sysmon detection content plus PE/function diff reports from patch analysis.

Vulnerability Details

Root Cause

PresentationEndpointFacade::ToastUnblockAll (and 48 other Facade methods across toast, tile, registration, settings, and delivery categories) retrieve the NotificationPlatform handle and immediately operate on it with no synchronization and no shutdown-state check. When the platform is torn down concurrently (e.g. during service stop/session teardown), the object backing the handle is freed while another thread’s Facade call still holds/derefs the now-dangling pointer — a classic use-after-free race. The June 2026 patch adds a shared/exclusive SRW lock (Wns::s_platformLock) plus a Wns::s_platformShutdown guard checked before every platform access, wrapped in RAII so the lock releases even on exception paths.

Attack Vector

1. A local, authenticated attacker repeatedly invokes WPN client APIs (toast/tile operations, registration, settings queries) that route through PresentationEndpointFacade.
2. Concurrently, the attacker induces or waits for WpnService/platform shutdown (e.g. via session logoff/service restart conditions).
3. If the Facade method’s pointer fetch and use straddles the platform’s free, the attacker can attempt to reclaim the freed memory (heap spray) with controlled data before the dangling pointer’s virtual call executes.
4. A successful race redirects control flow via the attacker-controlled vtable/data, running arbitrary code as NT AUTHORITY\SYSTEM.

The repository explicitly scopes out steps 3–4 (heap spray/vtable hijack/code-exec) as weaponization work; its focus is root-cause analysis, a generic TOCTOU demonstration lab, and detection engineering.

Impact

Successful exploitation of the underlying race would allow a local standard user to escalate to SYSTEM privileges via a core, always-running Windows service. Even without full weaponization, failed exploitation attempts are likely to crash WpnService/svchost.exe, which is itself a detectable indicator.

Environment / Lab Setup

Lab (does not touch real WpnService):
  - Requires GCC/MinGW on Windows 10/11.
  - lab/vulnerable_service.c: mock service using a named pipe + shared memory,
    double-fetches a length field with a 50ms sleep between fetches (TOCTOU window).
  - lab/race_attacker.c: sets a safe length, triggers the service, then flips the
    shared memory to an overflow value during the window.
  - lab/build.bat builds both with GCC (MinGW).
  - Run `vulnerable_service.exe --patched` to see the single-fetch fix (no race).

Detection tooling (real Windows systems):
  - detection/etw_wpn_monitor.ps1 — PowerShell, checks WpnService state/PID, crash
    history, event burst rates, named pipes, wpncore.dll patch level, loaded
    modules, and symlink/junction tampering.
  - detection/sysmon_wpn_race_detect.xml — Sysmon config with 6 rule groups
    (child-process spawn from svchost/netsvcs, WPN pipe access, file creation in
    notification paths, registry tampering, PROCESS_ALL_ACCESS handles to svchost,
    CreateRemoteThread into svchost).

Proof of Concept

PoC Script

See lab/vulnerable_service.c, lab/race_attacker.c, lab/build.bat in this folder (TOCTOU demonstration lab), plus detection/etw_wpn_monitor.ps1 and detection/sysmon_wpn_race_detect.xml (detection tooling), and reports/PE_DIFF_REPORT.txt / reports/FUNCTION_DIFF_REPORT.txt (patch-diff evidence).

1
2
3
4
5
6
7

build.bat
vulnerable_service.exe
race_attacker.exe 5
vulnerable_service.exe --patched

powershell -ExecutionPolicy Bypass .\detection\etw_wpn_monitor.ps1
sysmon64.exe -accepteula -i detection\sysmon_wpn_race_detect.xml

Running the lab demonstrates the class of double-fetch/TOCTOU bug generically (the attacker wins races against the vulnerable build and loses them against the --patched build); it does not exploit WpnService itself. The detection scripts identify whether a live system is patched and surface behavioral indicators consistent with race-condition exploitation attempts.

Detection & Indicators of Compromise

Event Viewer: Microsoft-Windows-PushNotifications-Platform/Operational
  - Event ID 1225 (transport-level WPN commands)
  - Event burst rate > 20/min — possible race spray attempt
  - Error/Critical level events — possible crash from a failed exploitation attempt

Sysmon rule groups (sysmon_wpn_race_detect.xml):
  WPN_EoP_ChildProcess    - svchost.exe (-k netsvcs) spawning cmd/powershell/wscript
  WPN_PipeAccess          - connections to WPN-related named pipes
  WPN_FileCreation        - file creation in notification data directories
  WPN_RegistryTampering   - writes to PushNotifications registry keys
  WPN_ProcessAccess       - PROCESS_ALL_ACCESS handles opened to svchost.exe
  WPN_ThreadInjection     - CreateRemoteThread targeting svchost.exe

Signs of compromise:

• Unexpected crashes/restarts of WpnService or its hosting svchost.exe -k netsvcs process.
• wpncore.dll file version/timestamp predating the June 2026 cumulative update (unpatched).
• Bursts of PushNotifications-Platform operational log events correlated with process creation from svchost.
• Unusual handles or remote-thread creation targeting the svchost process hosting WpnService.

Remediation

References

• Source repository
• MSRC advisory

Notes

Mirrored from https://github.com/grizzzer/CVE-2026-42978-PoC-Research on 2026-07-05.