Windows HTTP.sys contains an integer underflow flaw that, when triggered by a crafted HTTP request, allows an attacker who already has local authorization to bypass security checks and gain higher privileges. The vulnerability is a classic example of a boundary validation error, categorized as CWE-122 and CWE-191. Exploitation results in elevated local access, enabling the attacker to modify system configuration, install malware, or compromise other users on the same machine.

Affected Windows operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, and 26H1. Server editions impacted are Windows Server 2012 (including Server Core), 2012 R2 (Server Core), 2016 (including Server Core installation), 2019 (both Core and full), 2022, and the forthcoming Windows Server 2025 (both Core and full).

The CVSS score of 7.8 reflects a high‑severity local privilege escalation, and the EPSS score of 0.01753 (≈1.75%) indicates a low but non‑zero likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be local: an attacker must already be authenticated or present on the machine to craft the malicious HTTP request and trigger the integer underflow. Once executed, the attacker can achieve complete control of the target system.