CVE‑2026‑21250 exploits an untrusted pointer dereference in Windows HTTP.sys, enabling a logged‑in user to gain higher privileges locally. By manipulating the kernel request handling, an attacker can elevate a regular user account to SYSTEM, allowing unrestricted modification of system files, registry, and installation of software. The flaw maps to CWE‑822: Unvalidated Object Handle or Resource Handle Manipulation.

Affected systems include Microsoft Windows 11 build 24H2, 25H2, and 26H1, and Microsoft Windows Server 2022 23H2 Core, Windows Server 2025 and its Server Core edition. The vulnerability is present in both x86‑64 and ARM64 builds where HTTP.sys is active.

The CVSS v3 score of 7.8 indicates high severity, however the EPSS score of less than 1% shows the exploit probability is currently low. The vulnerability requires a local, authenticated attacker; remote attackers cannot trigger the flaw directly. Because it is not listed in the CISA KEV catalog, there is no known widespread exploitation yet, but the high impact warrants timely remediation.