An integer underflow in the Windows NT OS kernel can be triggered by an authorized local user to gain higher privileges. The flaw occurs when the kernel incorrectly processes a numeric value that wraps around, enabling the execution of code with elevated rights. Attackers could read or modify protected files, install malware, or expand their attack surface without remote access.

Microsoft Windows 10 releases 1607 through 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 – including server‑core installations. All affected systems run the NT kernel and may be compromised if the specific update that addresses CVE‑2026‑42916 is not installed.

The CVSS score of 7.8 indicates a high severity local privilege escalation. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified, but the flaw requires only local authorized access, making it a realistic risk in environments with privileged accounts. It is not currently listed in the CISA KEV catalog, so there is no evidence of widespread exploitation yet, yet any device that has not applied the Microsoft patch remains vulnerable.