The vulnerability is an untrusted pointer dereference in Windows HTTP.sys that allows an authenticated or authorized local user to ascend privileges. This flaw is identified as CWE-822, indicating an improper handling of untrusted memory references that can result in unintended privilege escalation. An attacker who already has limited local access can exploit this mis‑handling to gain elevated rights, potentially executing malicious code or compromising system integrity.

Microsoft Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1 and Microsoft Windows Server 2022 23H2 Edition (Server Core installation), Microsoft Windows Server 2025 and its Server Core edition are all affected by the vulnerability described. Remediation information is provided by Microsoft via the Security Update Guide linked in the references.

The issue has a CVSS score of 7.8, placing it in the high severity range, but the EPSS score is less than 1%, indicating a very low likelihood of exploitation in the wild at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires a user with existing local access, so the risk is primarily to systems that have vulnerable user accounts or residual privileges. Patching or upgrading mitigates the risk entirely.