Windows HTTP.sys CVE-2026-62741

Exploitation requires an authenticated local session on the target Windows system - the CVSS PR:L metric confirms a low-privilege account (standard user or equivalent) is sufficient; no administrative rights are needed to trigger the vulnerability. The attacker must be able to issue requests that reach the HTTP.sys kernel driver, which is accessible from any local user process on systems where HTTP.sys is loaded (effectively all Windows systems with networking enabled). No special non-default configuration is required - HTTP.sys loads by default on all affected Windows versions. Limiting factors: remote unauthenticated exploitation is not possible (AV:L); the attacker must have already established local presence through other means; and exploitation in kernel space is more complex to develop reliably than user-space vulnerabilities, which may extend time-to-weaponization. Note that the CWE-122 classification (heap-based buffer overflow) and the description's integer underflow framing are consistent but slightly diverge - the exact triggering input format is not specified in public disclosures at this time.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a low-complexity local privilege escalation requiring only authenticated user-level access with no user interaction - a straightforward LPE primitive for post-exploitation. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified probabilistically. KEV status is not confirmed, and no public proof-of-concept has been identified at time of analysis, which moderates urgency relative to a KEV-listed flaw. However, HTTP.sys is a kernel attack surface reachable from any local user process and the attack complexity is rated Low, meaning exploitation is not expected to require significant development effort once the precise overflow offset is known. The combination of kernel-space impact, AC:L, PR:L, and S:U with full C/I/A suggests this is a real priority for environments where untrusted local users are present (multi-tenant servers, VDI, terminal services, hosted Windows workloads). For single-user workstations with physical security controls, real-world risk is lower. The broad affected version range (12 years of Windows releases) increases aggregate exposure significantly.

An attacker who has obtained low-privileged local access to a Windows Server - for example via a compromised service account, a phishing-delivered payload, or initial foothold through another vulnerability - crafts a malformed HTTP request targeting the HTTP.sys kernel driver. The malformed input triggers the integer underflow, corrupting a heap allocation size in kernel memory. By controlling the overflow content, the attacker overwrites critical kernel data structures to redirect execution flow and achieve SYSTEM-level code execution on the host. No public proof-of-concept is known at time of analysis, but the low attack complexity rating indicates the exploitation path does not require advanced techniques once the specific overflow offset and target structure are identified.