Heap-based buffer overflow in Windows HTTP.sys permits an authorized user to gain elevated privileges locally. The flaw allows a local attacker to write data out of bounds on the heap, leading to the elevation of the process to a higher privilege level. The weakness is listed as CWE‑122 and CWE‑197, indicating a classic unbounded write and a potential signed integer overflow used to bypass bounds checks.

The vulnerability affects multiple Windows releases. Windows 10 editions 1809, 21H2, and 22H2 are impacted. Windows 11 builds 23H2, 24H2, 25H2, and 26H1 are also vulnerable. Server editions are affected as well; Windows Server 2019 and its Server Core installation, Windows Server 2022, and the upcoming Windows Server 2025 (including Server Core) all contain the exposed HTTP.sys component.

The CVSS score of 7.8 indicates high risk severity, while the EPSS score of 0.00246 (0.246%) shows exploitation probability is very low. The flaw is not listed in CISA KEV catalog. A local, authenticated attacker can exploit the flaw without the need for network access. The likely attack vector is local, inferred from the description that an authorized attacker can trigger the overflow. Exploitation would require delivering an HTTP request to the vulnerable system, possibly via local applications or scripts that leverage HTTP.sys.