EUVD-2026-44070
GHSA-3phq-4j2m-c959
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only exploitation requiring a low-privilege authenticated session; impact limited to confidentiality via kernel memory disclosure with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in HTTP.sys, the Windows kernel-mode HTTP driver, enables a local low-privileged attacker to disclose sensitive kernel memory contents on Windows 11 and Windows Server 2025. The CVSS vector (AV:L/PR:L) confirms exploitation is strictly local and requires an authenticated session - no remote or unauthenticated attack path exists. Microsoft has released patched builds; no active exploitation has been identified (SSVC Exploitation: none; EPSS 0.41%, 33rd percentile), and this vulnerability is not listed in CISA KEV.
Technical ContextAI
HTTP.sys is the Windows kernel-mode driver implementing the HTTP/1.1 protocol stack and underpins IIS, WinRM, Windows Update, and other HTTP-based OS services. CWE-125 (Out-of-Bounds Read) indicates the driver reads beyond the boundary of an allocated buffer, potentially exposing adjacent uninitialized or otherwise protected kernel memory to the calling process. The flaw is confined to recently released Windows 11 builds and Windows Server 2025 per CPE data (cpe:2.3:a:microsoft:windows_11_version_24h2, windows_11_version_25h2, windows_11_version_26h1, windows_server_2025, windows_server_2025_(server_core_installation)), suggesting it was introduced during a recent development cycle rather than representing a long-standing architectural weakness in HTTP.sys.
RemediationAI
Apply Microsoft's security update to bring affected systems to the following fixed build versions: Windows 11 Version 24H2 to build 10.0.26100.8875 or later, Windows 11 Version 25H2 to build 10.0.26200.8875 or later, Windows 11 Version 26H1 to build 10.0.28000.2269 or later, and Windows Server 2025 (including Server Core Installation) to build 10.0.26100.33158 or later. Updates are available via Windows Update and the Microsoft Update Catalog; the authoritative advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50420. Where immediate patching is not feasible, applying least-privilege principles to reduce the pool of local users who can interact with HTTP.sys-dependent services (IIS, WinRM) may limit the attack surface - however, this is not a substitute for patching, as standard local user access is sufficient to trigger the vulnerability.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today