Windows HTTP.sys EUVD-2026-56368

The attacker must hold a valid, low-privileged local account on the target Windows system (PR:L - some form of authenticated local access is required). The attack vector is local (AV:L), meaning the attacker cannot trigger this remotely without a pre-existing foothold. No user interaction is required once local access is achieved (UI:N), and attack complexity is low (AC:L), implying no race conditions, non-default configuration, or unusual environment is needed beyond local logon capability. What limits exploitation: remote unauthenticated attackers cannot directly exploit this; an attacker must first obtain local system access through another vector. There is no indication that HTTP.sys must be serving active requests or that IIS must be running - the vulnerable code path appears reachable from a local user context regardless of whether HTTP server features are in active use.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 7.8 and correctly characterizes this as a local, low-complexity privilege escalation requiring minimal privileges. The low attack complexity rating suggests reliable exploitation without race conditions or unusual configurations. The scope is unchanged (S:U), meaning the exploit does not jump to other systems, but the C:H/I:H/A:H triad indicates full control of the compromised host. No KEV listing is present in the provided data, meaning CISA has not confirmed active exploitation; no public POC is identified either. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. Despite no confirmed active exploitation, this vulnerability is high-priority for organizations with internet-facing Windows web servers or shared systems where low-privileged users exist, because the low AC and PR:L combination means a determined local attacker faces few technical barriers. The primary mitigating factor is that an attacker must already have a foothold on the target system.

An attacker who has already compromised a low-privilege Windows account - through phishing, credential theft, or exploitation of a separate remote vulnerability - sends a specially crafted request or API call that triggers the heap overflow in the HTTP.sys kernel driver. The corrupted kernel heap enables overwriting a security-critical structure, allowing the attacker to execute code as SYSTEM. No public exploit code has been identified at time of analysis, but the low attack complexity rating suggests the exploit path is technically straightforward once a researcher has reversed the patch.