The vulnerability originates from the use of an uninitialized resource within Windows HTTP.sys, an integral component that handles HTTP traffic on Windows systems. This flaw allows an authorized local attacker to read unintended data from memory, potentially exposing sensitive configuration or cached credentials. The weakness is classified as CWE‑908.

Affected systems include various releases of Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), and several editions of Windows Server from 2012 through 2025. All versions that contain the vulnerable HTTP.sys driver are impacted, regardless of architecture, as reflected by the associated CPEs. The issue is present across x86, x64, and ARM64 platforms where HTTP.sys is enabled.

The CVSS score of 5.5 reflects a moderate severity, and the EPSS score is unavailable, indicating no publicly known exploitation data. Because the flaw requires local, authorized access, remote exploitation is not feasible; the vulnerability is not listed in the CISA KEV catalog. Users should apply Microsoft’s patch that addresses CVE‑2026‑83714, or implement temporary mitigation by disabling unnecessary HTTP services and enforcing the principle of least privilege for local accounts interacting with HTTP.sys.