EUVD-2026-22617Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
6DescriptionCVE.org
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Windows HTTP.sys kernel-mode driver allows unauthenticated remote attackers to crash affected systems via malformed HTTP requests. Affects all currently supported Windows 11 versions (22H2 through 26H1) and Windows Server 2022/2025 editions. The vulnerability stems from an out-of-bounds read (CWE-125) triggered when HTTP.sys processes specially crafted network packets without authentication (CVSS AV:N/PR:N). Vendor-released patches available for all affected versions with specific build numbers identified. No public exploit identified at time of analysis, though low attack complexity (AC:L) suggests straightforward exploitation once technical details emerge.
Technical ContextAI
HTTP.sys is a Windows kernel-mode driver responsible for processing HTTP requests before they reach user-mode web applications like IIS. This out-of-bounds read (CWE-125) occurs when HTTP.sys parses malformed HTTP protocol data, causing the driver to read memory beyond allocated buffer boundaries. Unlike typical buffer overflows that enable code execution, out-of-bounds reads in kernel-mode drivers typically trigger system crashes (BSOD) when invalid memory is accessed, resulting in high availability impact. The vulnerability exists across the HTTP.sys implementation in Windows 11 builds 10.0.22631 through 10.0.28000 and Windows Server 2022/2025 builds 10.0.20348 through 10.0.26100, indicating a persistent flaw in the HTTP protocol parsing logic across multiple kernel generations.
RemediationAI
Apply Microsoft-released security updates immediately to patch the HTTP.sys vulnerability. Update Windows 11 version 22H2/23H2 to build 10.0.22631.6936 or later, Windows 11 version 24H2 to build 10.0.26100.32690 or later, Windows 11 version 25H2 to build 10.0.26200.8246 or later, Windows 11 version 26H1 to build 10.0.28000.1836 or later, Windows Server 2022 to build 10.0.20348.5020 or later, Windows Server 2022 23H2 Edition to build 10.0.25398.2274 or later, and Windows Server 2025 editions to build 10.0.26100.32690 or later. Patches are distributed through Windows Update and Microsoft Update Catalog. For systems that cannot be immediately patched, consider network-level controls to restrict HTTP/HTTPS traffic to trusted sources only, though this is not a substitute for patching. Prioritize internet-facing web servers and critical availability systems. Full remediation guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today