Windows HTTP.sys EUVD-2026-99196

Exploitation requires LOCAL access to the affected Windows host plus a valid low-privilege authenticated session (CVSS PR:L, 'authorized attacker'); there is no remote or network-facing entry path despite HTTP.sys handling HTTP traffic - the attack vector is local (AV:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a foothold exists the trigger is reliable. LIMITING FACTORS: the attacker must already be authenticated on the system, the host must run an affected, unpatched build (see the EUVD version ranges across Windows 10/11, Windows Server 2012 through 2025, including Server Core installations), and because the primitive is an out-of-bounds read, achieving full code execution likely requires additional exploitation effort to convert the read into control-flow hijack. Multi-user systems (terminal servers, shared/RDP hosts) where untrusted users hold local accounts face the highest realistic exposure.

This is a moderate-priority local privilege/code-execution issue, not an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires LOCAL access and low-level authentication (an 'authorized attacker' with an existing foothold), not remote unauthenticated reach - which caps real-world urgency despite the 7.8 base score and the high C:H/I:H/A:H impact. All exploitation signals point low: CISA SSVC lists Exploitation=none and Automatable=no (so no observed exploitation and no reliable automation/wormability), there is no CISA KEV listing, and no public exploit was identified at time of analysis. SSVC Technical Impact=total aligns with the full C/I/A impact, meaning a successful exploit is serious - but only after an attacker is already authenticated on the host. Note a signal tension worth flagging: the description characterizes the flaw as an 'out-of-bounds read' (a read primitive, CWE-125) and the tags emphasize 'Information Disclosure,' yet both the description and the CVSS vector assert code execution with I:H/A:H - an OOB read alone typically yields disclosure, so the full integrity/availability impact likely depends on chaining the read primitive into control-flow corruption; treat the RCE characterization as vendor-asserted and verify exploitability details with Microsoft. Overall: patch on normal cadence (prioritize multi-user/terminal-server hosts), but this is not a drop-everything flaw given the local-only vector and absence of any exploitation evidence.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via a standard user account or a compromised low-privilege service) triggers the out-of-bounds read in the HTTP.sys kernel driver to corrupt kernel memory and execute code in a higher-privilege context. Because the CVSS vector is AV:L/PR:L, this is a local privilege-escalation / code-execution step rather than a remote entry point, and no user interaction is required. No public exploit code has been identified at time of analysis.