CVE-2026-62735 is a heap-based buffer overflow flaw in Windows HTTP.sys that allows an attacker with local access to elevate privileges. The vulnerability stems from missing bounds checking (CWE-122) and arithmetic overflow (CWE-190) in HTTP request processing, enabling a crafted request to corrupt heap memory and execute arbitrary code at higher privilege. The impact is confined to the host machine, granting the attacker potential administrator rights and enabling lateral movement if network services are compromised.

Affected are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including core installations.

The CVSS score of 7.8 classifies this flaw as high severity for local privilege escalation. EPSS is < 1%, indicating very low current exploitation probability, and it is not listed in the CISA KEV catalog. The attack vector is clearly local, requiring the attacker to be authenticated and able to send HTTP requests to HTTP.sys. Once the heap overflow is triggered, exploitation is trivial, making this a significant risk for systems with inadequately protected local accounts or exposed HTTP endpoints.