Microsoft HTTP.sys EUVD-2026-73553

Exploitation requires the attacker to already hold a low-privileged authenticated/authorized position (PR:L) and to send crafted traffic to the kernel-mode HTTP.sys driver, which is present and active by default on the affected Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2025 systems whenever the HTTP stack services requests. The primary limiting factor is the high attack complexity (AC:H): the use-after-free is a race condition that the attacker must reliably win to corrupt kernel memory, making exploitation non-deterministic. No user interaction is required (UI:N). Risk is bounded to systems running unpatched builds below the fixed versions (e.g., 24H2 <10.0.26100.9445, Server 2025 <10.0.26100.33438) and to environments where the attacker can reach the HTTP.sys endpoint with authenticated access.

This is a memory-corruption (use-after-free) elevation-of-privilege flaw in Windows HTTP.sys carrying a vendor CVSS 3.1 base of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent and point to a real-but-not-emergency priority. The high complexity (AC:H) reflects the race-condition nature typical of UAF exploitation, and PR:L means the attacker must already be an authenticated/authorized principal on the network, which tempers the network attack vector. Corroborating this, EPSS is low at 0.57% (45th percentile), CISA SSVC records Exploitation=none and Automatable=no (so no reliable, scriptable mass-exploitation), and there is no KEV listing and no public exploit code - meaning no public exploit identified at time of analysis. The one signal pulling upward is SSVC Technical Impact=total, matching the full C:H/I:H/A:H (kernel-level compromise if successfully exploited). Net: a legitimately serious kernel bug in a ubiquitous component, but the combination of AC:H, PR:L, low EPSS, and no observed exploitation makes it a patch-in-normal-cycle item rather than a drop-everything emergency. No signals are contradictory; the main uncertainty is that HTTP.sys UAF EoP bugs have historically been made reliable over time, so the low complexity margin could erode as research matures.

An authenticated attacker with a foothold on a system (or reachable over the network to the HTTP.sys-backed service) sends specially timed/crafted HTTP requests that trigger a use-after-free in the kernel-mode HTTP.sys driver, winning a race to reuse the freed object. Successful exploitation corrupts kernel memory and lets the attacker execute code in kernel context, elevating from a low-privileged account to SYSTEM. No public proof-of-concept exists at time of analysis, and the high attack complexity (AC:H race window) makes reliable exploitation non-trivial.