Windows HTTP.sys CVE-2026-62811

Exploitation requires a low-privileged authenticated account on the target Windows machine - either via interactive logon, RDP, or code execution under a limited-privilege process. The CVSS vector confirms PR:L (low-privilege account required) and AV:L (local attack vector), meaning the attacker must already have some form of local access. No user interaction (UI:N) or special configuration is indicated as required beyond the attacker having a valid low-privileged session. What limits exploitation: remote-only attackers cannot directly trigger this flaw; an initial access vector (credential compromise, phishing, web shell, etc.) is a prerequisite. The vulnerability does not appear to require HTTP.sys to be actively serving external traffic - the local driver interaction surface is sufficient.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, reflecting a local attack requiring only a low-privileged account but yielding full confidentiality, integrity, and availability impact. Attack complexity is Low, meaning no race conditions or special environmental factors are required beyond local authenticated access - this lowers the bar for exploitation significantly. No EPSS data was provided in the input, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present and no public POC is mentioned, suggesting exploitation remains opportunistic or theoretical at time of analysis. However, local privilege escalation vulnerabilities in kernel drivers are routinely chained with initial access vectors (phishing, RCE flaws, credential compromise) and represent a critical second-stage capability. The breadth of affected Windows versions - spanning multiple current Windows 11 releases and both Windows Server 2022 and 2025 - amplifies aggregate organizational exposure. This is a genuine patching priority rather than a high-CVSS-but-low-real-risk finding.

An attacker who has gained a low-privileged foothold on a vulnerable Windows host - for example, via a phishing-delivered payload or compromised service account - crafts a malformed request to the HTTP.sys driver that triggers the heap-based buffer overflow. The resulting kernel memory corruption allows the attacker to overwrite a critical data structure and redirect execution, elevating from a standard user context to SYSTEM without any user interaction or elevated complexity required.