Windows HTTP.sys CVE-2026-70208

Exploitation requires the attacker to already have local, authenticated access to the affected Windows host (AV:L, PR:L) - this is not a remote or unauthenticated vector despite HTTP.sys being the HTTP protocol stack. No user interaction is needed (UI:N) and complexity is low (AC:L), so once a low-privileged local account is present the out-of-bounds read is readily triggered. Impact is limited to information disclosure (C:H, I:N, A:N) with no scope change (S:U); the main limiting factors are the prerequisite local foothold and existing authentication, which exclude purely external attackers. Affected systems are Windows builds below the patched versions listed in EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650); patched builds are not exploitable.

This is a moderate-severity information-disclosure flaw (CVSS 5.5) whose signals are consistent and point to LOW real-world urgency rather than an emergency. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a local, low-complexity, authenticated attack that leaks data but causes no integrity or availability impact. CISA's SSVC decision aligns: Exploitation=none, Automatable=no, Technical Impact=partial - i.e., no observed exploitation and not scalable/wormable, which fits a local info-leak. The CVE is NOT in CISA KEV and no public exploit code was provided, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from the input. There is no conflict among the signals: a local vector, the need for prior authentication (PR:L), the absence of KEV/POC, and the 'partial' technical impact all converge on a patch-in-normal-cycle priority. The one tension worth noting is severity perception versus reach: C:H denotes high confidentiality impact (kernel/driver memory can contain sensitive material), but the local-only, authenticated preconditions sharply limit who can abuse it. The counterweight to deprioritization is prevalence - HTTP.sys ships in essentially all Windows servers and clients - so patch coverage matters at scale even though per-host exploitability is constrained.

An attacker who already has a low-privileged authenticated foothold on a Windows host crafts input that drives HTTP.sys to read past an allocated buffer boundary, returning adjacent kernel/driver memory that may contain sensitive data usable for further privilege escalation or lateral movement. No public proof-of-concept was identified at the time of analysis. The local attack vector (AV:L) and low complexity (AC:L) mean exploitation is technically easy once local access exists, but it cannot be launched remotely by an unauthenticated attacker.