Windows HTTP.sys contains a heap-based buffer overflow that can be triggered by an authorized user crafting malicious HTTP requests. By corrupting memory, an attacker can gain elevated local privileges, potentially executing arbitrary code as a higher-privileged account. This weakness stems from improper bounds checking (CWE‑122). The local surface means the threat requires the attacker to have some level of local access, but once achieved it can lead to complete compromise of the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations. These operating systems rely on HTTP.sys and are vulnerable until patched.

The CVSS score is 7, indicating a high severity. EPSS is not available, but the lack of a KEV listing suggests no known active exploitation at the time of assessment. The attack vector is local authentication; an authorized user can send crafted packets to HTTP.sys which triggers the overflow. Once exploited, privilege escalation to system-level is possible. The vulnerability requires local user credentials and knowledge of HTTP service configuration, so the risk is significant for systems exposed to untrusted input or misconfigured servers.