Microsoft Windows CVE-2026-49788

The vulnerable target must have the Windows HTTP/2 protocol handler enabled and reachable - i.e., an HTTP/2-capable endpoint such as IIS or an HTTP.sys-based service accepting HTTP/2 (typically over TLS) on a network-reachable interface. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required against such a configuration, so an internet-exposed HTTP/2 service is directly at risk. What limits exploitation: endpoints that do not negotiate HTTP/2 (HTTP/1.1-only, or HTTP/2 disabled) are not exposed to this vector, and hosts reachable only from trusted internal networks face reduced risk; impact is confined to availability (service disruption) with no data compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction and impact limited entirely to availability - consistent with a resource-exhaustion DoS rather than a compromise. No EPSS score, SSVC decision, POC, or KEV entry was provided in the input, so exploitation probability cannot be quantified from the data given; it is not confirmed actively exploited. The realistic priority is moderate-to-high for internet-facing HTTP/2 endpoints (IIS, HTTP.sys services) because the barrier to exploitation is low and the affected footprint is large, but it does not enable code execution or data exposure. Note a caveat: the CVSS metrics assert a pure network vector with no privileges, yet no independent EPSS or exploit-maturity signal is available to confirm whether working exploitation is trivial or requires a non-default HTTP/2 configuration - verify against the Microsoft advisory before assuming worst case.

An unauthenticated attacker opens HTTP/2 connections to an internet-facing Windows service (for example an IIS site or HTTP.sys-hosted application) and issues a stream of crafted HTTP/2 frames or streams that each trigger unbounded server-side allocation. Because the attack requires no authentication, no user interaction, and low complexity, a single modest client can drive the server into memory/CPU exhaustion and take the service offline. No public POC was identified at time of analysis.