The vulnerability is an out‑of‑bounds read in the Windows HTTP.sys kernel driver that permits an authorized attacker to execute code locally. Classified as CWE‑125, the flaw allows the attacker to read beyond the bounds of a buffer, which can be leveraged to execute arbitrary code. This requires the attacker to have local or process‑level access capable of manipulating HTTP.sys requests.

Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2012, Server 2012 (Server Core), Server 2012 R2, Server 2012 R2 (Server Core), Server 2016, Server 2016 (Server Core), Server 2019, Server 2019 (Server Core), Server 2022, and Server 2025 (including Server Core).

The CVSS score of 7.8 indicates a high severity impact. EPSS data is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. The exploit vector is local; an attacker must already possess authorized access to the target system to trigger the code execution flaw.