Integer overflow or wraparound in Windows HTTP.sys permits an attacker without authentication to execute code over the network, resulting in full remote code execution on the affected system. The flaw is a classic integer and buffer overflow weakness (CWE-122, CWE-190), allowing the attacker to manipulate internal state and launch arbitrary instructions.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). Any machine running HTTP.sys service on these operating systems is potentially vulnerable.

With a CVSS score of 9.8, the flaw is considered critical; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires only network access to the HTTP.sys endpoint and no authentication, making it an easily exploitable remote attack vector. An adversary can send a crafted HTTP request that triggers the integer wraparound, leading to arbitrary code execution on the target host.