The vulnerability arises from an out‑of‑bounds read within the Windows HTTP.sys driver. An adversary who can send crafted HTTP requests can trigger a read past the bounds of allocated memory. The resulting fault causes the HTTP.sys component to crash, which in turn brings the web services that depend on it down. Because the fault occurs in a core networking stack, the impact is a denial of service rather than data compromise. This weakness corresponds to the OWL CWE‑125 class of out‑of‑bounds read defects.

Affected are Microsoft Windows 11 operating systems with release versions 23H2, 24H2, 25H2, 22H3 and 26H1, as well as Windows Server 2022 and Windows Server 2025, including their Server Core editions. The flaw exists in the HTTP.sys component that handles HTTP traffic across these Windows releases.

The CVSS v3.1 score of 7.5 indicates a high severity level, while the lack of an EPSS rating prevents a precise probability estimate. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at the time of publication. The attack vector is inferred to be remote, as the fault is triggered by network traffic received over HTTP; no elevated privileges or local access are required. Consequently, the risk to availability is significant, especially for services that rely heavily on HTTP.sys for processing requests.