Windows HTTP.sys CVE-2026-62735

Exploitation requires an authenticated local user session - the CVSS vector PR:L confirms a low-privileged account suffices, and AV:L confirms the attacker must have local access (physical, RDP, SSH, or equivalent session). No user interaction from a second party is required (UI:N). The scope does not change (S:U), meaning impact is confined to the vulnerable Windows host. No special non-default configuration of HTTP.sys appears required based on available data, as HTTP.sys is loaded by default on all Windows installations where IIS or any HTTP.sys-dependent service is active. Exploitation is limited to: (1) the attacker must already hold or have compromised a local account; (2) attack is constrained to local privilege escalation - remote unauthenticated exploitation is not indicated by the AV:L vector.

The CVSS 7.8 High score is well-supported by the vector: AV:L (local access required) contains the blast radius, but AC:L/PR:L/UI:N means any low-privilege local account can reliably trigger exploitation without assistance or complex preconditions. High C/I/A impact (S:U) reflects full SYSTEM-level compromise of the vulnerable host. The real-world risk is primarily as a second-stage escalation primitive - an attacker who has already obtained a foothold (via phishing, credential theft, or another vulnerability) can use this to escalate from a standard or service account to SYSTEM, enabling persistence, credential dumping, or lateral movement. No EPSS data was provided in the input, and the absence of KEV listing and POC reduces immediate automated exploitation risk; however, the low complexity and broad version coverage make weaponization straightforward once a researcher publishes details. The broad affected surface (Windows 10 through Windows 11, Server 2012 through Server 2025) makes this a high-priority patch given enterprise exposure.

An attacker who has compromised a low-privilege local user account - through credential phishing, password spraying, or exploitation of a separate initial-access vulnerability - executes a crafted local payload that sends malformed input to the HTTP.sys kernel driver, triggering the heap buffer overflow. The overflow corrupts kernel pool memory adjacent to the allocation, allowing the attacker to overwrite a security token or function pointer and execute code as SYSTEM. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests that kernel exploit development would be straightforward for a skilled researcher once the patch differential is analyzed.