Executive brief
A critical vulnerability exists in the Windows component responsible for handling web traffic (HTTP.sys). This flaw allows a remote, unauthenticated attacker to run malicious code on a server or workstation over the network. An exploit could lead to a complete system takeover, data theft, or significant service disruption without any user interaction.
Technical details
This vulnerability is classified as an integer overflow (CWE-190) leading to a heap-based buffer overflow (CWE-122) within the Windows HTTP protocol stack (HTTP.sys). The flaw is triggered when the driver incorrectly handles specially crafted HTTP requests, resulting in memory corruption. Because HTTP.sys runs in kernel mode, successful exploitation allows for remote code execution (RCE) with high privileges. The attack vector is network-based, requires no authentication, and involves no user interaction, making it highly wormable. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: disclosed: Initial publication by Microsoft and NVD.
- 2026-06-09: patched: Security updates made available by Microsoft.