Windows HTTP.sys CVE-2026-83705

Exploitation requires the attacker to already have authorized low-privilege execution on the target Windows host (PR:L, AV:L) - this is a local, post-authentication information-disclosure flaw in the HTTP.sys kernel-mode driver, not a remote one. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the local-access and existing-privilege requirements are the primary limiting factors: a remote, unauthenticated attacker cannot trigger it directly. It applies to default configurations because HTTP.sys is a core OS component present on all listed Windows client and server builds; no special feature or non-default configuration is called out in the advisory.

This is a genuinely moderate, low-urgency issue rather than a top-tier priority, and the signals are consistent with that. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable information disclosure requiring the attacker to already hold low-level privileges on the host; there is no integrity or availability impact and no scope change. CISA's SSVC decision framework reinforces the low urgency: Exploitation=none, Automatable=no, Technical Impact=partial - i.e. no observed or expected exploitation, it cannot be reliably scripted at scale, and the impact is only partial. There is no CISA KEV listing and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. The one point to note for defenders is that although HTTP.sys is the kernel-mode HTTP stack that typically faces the network, this specific flaw is explicitly local (AV:L) and requires existing authorization (PR:L), so it is a post-compromise information-leak primitive (useful for privilege escalation chains or sandbox escape reconnaissance), not a remote network-facing threat. No conflicting signals were found between the CVSS vector and the description - both agree on local, authorized access disclosing high-confidentiality information.

An attacker who already has a low-privileged foothold on a Windows host (e.g. a standard local user or a constrained service account) runs code locally that interacts with the HTTP.sys stack to read sensitive system information it should not be able to access, such as memory contents or configuration data. No public exploit code is known, and because exploitation is local with low privileges and no user interaction, it would most plausibly be used as a reconnaissance or privilege-escalation aid after an initial compromise rather than as an initial access vector.