CVE-2026-42981
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
An integer underflow vulnerability in Windows Performance Monitor allows an unauthorized attacker to execute code remotely over a network.
Risk Assessment
An attacker can remotely execute code on a system running Windows Performance Monitor, potentially leading to full system compromise.
Recommendation
Install the security update from Microsoft for Windows Performance Monitor.
Other vulnerabilities in Windows Performance Monitor
See all- CVE-2026-85359High
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
- CVE-2026-85333Medium
A race condition vulnerability (concurrent execution using a shared resource with improper synchronization) in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
- CVE-2026-69324High
Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
- CVE-2026-42974High
An integer overflow vulnerability in Windows Performance Monitor allows an unauthorized attacker to execute code remotely over a network.
Original NVD description (English source)
Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS