# CVE-2026-42910 — Windows Hotpatch Monitoring Service `hpatchmon.dll` Unbounded Event-String Construction in the ETW Callbacks → Out-of-Bounds Write

---

## Summary

| | |
|---|---|
| **Product** | Windows — `hpatchmon.dll` (Hotpatch Monitoring Service) |
| **CVE ID** | CVE-2026-42910 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-787: Out-of-bounds Write |
| **Delivery** | Local — a crafted ETW autologger trace event consumed by the service |
| **KB / Fixed build** | KB5094126 — `hpatchmon.dll` 10.0.26100.8655 (Win11 24H2 x64) |
| **Patch Date** | June 9, 2026 (2026-Jun) |
| **Pre-patch binary** | `hpatchmon.dll` 10.0.26100.8521 — SHA256 `ed153cdb035b2a12773dfc079e9e4d609da116fbd1898b0ee9cd8949f16cfcee` |
| **Post-patch binary** | `hpatchmon.dll` 10.0.26100.8655 — SHA256 `501b504c570e6f1c5192559255d10bd57a19fefee73eb8b9f08ffb089213a869` |
| **Feature flag** | `Feature_1648861496` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`hpatchmon.dll` implements the **Hotpatch Monitoring Service**, which runs as SYSTEM
and consumes an ETW **autologger** trace to observe hotpatch activity.
`autologgerProcessor::AutologgerProcessEventCallback` and
`TraceUtil::ProcessEventCallback` are invoked per ETW event and parse the event's
user data — including `WCHAR` strings — into local buffers / `std::wstring`.

---

## Vulnerability Summary

Pre-patch, these callbacks constructed strings from the ETW event-data pointer using
an **unbounded** `std::basic_string` construction that did not correctly respect the
event-data length. A crafted or oversized trace event therefore drove a copy past
the destination buffer — an out-of-bounds write (CWE-787) in the SYSTEM service.
Because the event data is attacker-influenceable and the service runs as SYSTEM, the
OOB write is a local elevation-of-privilege primitive to SYSTEM (per the MSRC FAQ).

> Confirmation: the event callbacks are confirmed code-changed under
> `Feature_1648861496` with the bounded-construction rework below; the exact
> overflowing write is entangled in the string-handling refactor, so it is stated at
> confirmed-changed level, consistent with the CWE-787 classification.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): influence an ETW autologger trace
  event that the Hotpatch Monitoring Service consumes.
- Craft the event's string user data so its length exceeds the destination buffer.
- Result: an out-of-bounds write inside the SYSTEM service.

---

## Vulnerability Details

### Root Cause

The ETW event callbacks built `std::wstring` values from event-data pointers without
bounding the copy to the actual event-data length, so an over-long event string
overwrote adjacent memory.

### The patch (confirmed — diff, .8521 → .8655)

Gated behind `Feature_1648861496`, both callbacks now build the strings via a
**bounded, explicit-length construction** — `std::basic_string::_Construct<1,
unsigned_short const*>` — with the local string pointers pre-initialized, so the copy
is limited to the real data length:

```c
// AutologgerProcessEventCallback / ProcessEventCallback (10.0.26100.8655) — PATCHED (from our diff)
// pre : basic_string<WCHAR>::basic_string(<event-data ptr>)          // unbounded construction
// post (Feature_1648861496):
local_c8 = (wchar_t *)0x0;
std::basic_string<WCHAR>::_Construct<1, unsigned short const *>(...); // explicit-length, bounded
```

With the bounded `_Construct`, the string copy no longer runs past the destination,
closing the out-of-bounds write.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1648861496`.** The bounded construction runs only when
the flag is enabled; the original unbounded construction still ships when disabled.
Verify `Feature_1648861496` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** ETW autologger events with oversized/malformed string fields
consumed by the Hotpatch Monitoring Service; OOB-write / heap-corruption crashes in
`hpatchmon!autologgerProcessor::AutologgerProcessEventCallback` /
`TraceUtil::ProcessEventCallback` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_1648861496` is enabled.

---

## References

- MSRC advisory — CVE-2026-42910 (Windows Hotpatch Monitoring Service Elevation of Privilege), released 2026-06-09, KB5094126.
- Full binary diff: `/data/patch_diffs/hpatchmon_dll-cve-2026-42910-ghidriff.md`