This vulnerability involves an integer underflow (wrap or wraparound) in the Windows Performance Monitor on Windows 11 version 23H2 (build 10.0.22631.0). Exploitation could allow remote code execution by an attacker without privileges or user interaction. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this integer underflow vulnerability can lead to remote code execution, allowing an attacker to run arbitrary code on the affected system. This compromises system confidentiality, integrity, and availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing its risk.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 11 version 23H2 (build 10.0.22631.0) as soon as possible. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42981 for detailed patch information and update instructions.