Windows HTTP.sys CVE-2026-61937

Exploitation requires an existing authenticated local session with at minimum low-privilege user rights on the target Windows system, as confirmed by the CVSS vector metrics PR:L and AV:L. The attacker must be capable of executing code locally - this can be achieved through a compromised low-privilege account, a prior exploitation of a remote code execution vulnerability, or access via Remote Desktop or similar remote session services. HTTP.sys is active by default on Windows systems where IIS or other HTTP.sys-dependent services are running, but the local attack vector means the vulnerability is not directly reachable by unauthenticated remote network attackers without a prior foothold. The scope-unchanged metric (S:U) confirms the exploit does not directly jump to other systems. Exploitation is limited by the requirement for prior local access; purely network-based, unauthenticated exploitation is not supported by the available CVSS data. No additional non-default configuration is stated as required beyond the local logon prerequisite.

The CVSS 7.8 (High) score reflects the full C/I/A impact of achieving SYSTEM privilege but is appropriately tempered by the local attack vector (AV:L) and low-privilege prerequisite (PR:L) - an attacker must already possess an authenticated local session or local code execution capability before exploiting this flaw. The scope is unchanged (S:U), meaning the exploit does not directly pivot to other systems in a single step, though a SYSTEM-level compromise of a server or endpoint can enable extensive lateral movement. No EPSS data was supplied, preventing a probabilistic exploitation likelihood assessment. The absence of a CISA KEV listing and any referenced POC code suggests the vulnerability has not yet been weaponized at scale; however, the low attack complexity (AC:L) implies that once a functional exploit is developed, it would likely be highly reliable and repeatable. The breadth of affected versions - covering essentially every currently supported Windows release plus two end-of-life Server 2012 variants still common in enterprises - materially elevates real-world exposure despite the local-only vector. Organizations with multi-tenant environments, shared hosting, RDS/Citrix deployments, or where unprivileged users have local logon rights should treat this as urgent. The missing EPSS signal is a gap worth noting: without it, exploitation probability cannot be quantified from available data.

A low-privileged user or malware process already running on a Windows host crafts a request or API call targeting HTTP.sys that supplies an integer value causing an overflow in a size calculation within the kernel-mode driver, resulting in an undersized heap buffer allocation. The attacker then writes beyond the allocated buffer's bounds, corrupting adjacent kernel heap structures or function pointers in a controlled manner to redirect kernel execution flow. Because no public POC has been identified at time of analysis, the precise trigger mechanism is not publicly confirmed, but the low attack complexity rating (AC:L) indicates the exploit path, once developed, would be straightforward and reliably repeatable - making this a high-value target for post-exploitation toolkits and commodity malware seeking SYSTEM privileges.