Integer overflow or wraparound in Windows HTTP.sys permits an attacker without authentication to deliver crafted network traffic that manipulates internal counters, leading to arbitrary code execution. The flaw is a classic buffer overflow (CWE-122) and integer wraparound (CWE-190) weakness, allowing the attacker to reach kernel memory and run arbitrary code with system privileges.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Windows Server 2012 (all editions, including Server Core), 2012 R2, 2016, 2019, 2022, 2025 (all editions, including Server Core). Any machine running HTTP.sys service on these operating systems could be exposed.

The CVSS score of 9.8 indicates critical severity, and an EPSS score of 23% suggests that the vulnerability is actively targeted. Because the flaw requires only network connectivity to HTTP.sys and no authentication, the attack vector is readily available to external actors. An adversary can construct a malicious HTTP request that triggers the integer wraparound, leading to arbitrary code execution with full system privileges.