Description

Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:17.497Z",
  "pubdate": "2026-08-11T17:18:17.497Z",
  "executiveSummary": "An integer overflow or wraparound vulnerability exists within Windows HTTP.sys, a core operating system kernel driver responsible for processing Hypertext Transfer Protocol requests. This security flaw enables a locally authenticated adversary to execute arbitrary code with elevated privileges, potentially leading to complete system compromise. The vulnerability affects systems utilizing the vulnerable HTTP.sys component to handle local or remote web traffic and kernel-mode HTTP request routing. Risk implications are critical due to the kernel-level execution context of the driver, allowing malicious actors to bypass standard security boundaries and access restricted operating system resources. Exploitation of this vulnerability requires local access to the target host and prior authentication, along with the ability to execute low-privileged code on the system. Successful exploitation grants the attacker the capability to escalate privileges from a standard user context to administrative or system-level integrity levels. Remediation requires the application of official vendor patches designed to correct arithmetic boundary checks within the affected request-handling routines of the driver.",
  "technicalDetails": "The vulnerability stems from an arithmetic flaw, specifically an integer overflow or wraparound condition, located within the request-processing logic of the Windows HTTP.sys kernel-mode driver. When HTTP.sys parses incoming HTTP headers, URI strings, or chunked transfer-encoding payloads, it calculates memory allocation sizes based on length parameters supplied within the request. If an attacker crafts a malicious request containing specially manipulated length or size headers, the arithmetic operation used to determine the required buffer size results in an integer overflow. This wraparound causes the memory allocation routine to reserve a buffer significantly smaller than the actual data size expected to be copied into it. Consequently, when the driver subsequently copies the parsed data into the undersized heap or pool buffer, a classic heap-based buffer overflow or out-of-bounds write occurs in kernel memory. The root cause is the absence of robust integer overflow validation checks prior to performing memory allocation calculations. Exploitation occurs step-by-step as follows: First, the authenticated local attacker establishes a communication channel with the HTTP.sys driver, either via standard local web applications hosted on Internet Information Services (IIS) or by directly opening handles to the driver endpoint. Second, the attacker transmits the crafted HTTP request containing malicious headers designed to trigger the arithmetic wraparound during size evaluation. Third, the resulting undersized buffer allocation causes memory corruption in kernel space when the oversized payload is written. Fourth, the attacker leverages this memory corruption primitive to manipulate kernel data structures, alter function pointers, or overwrite object headers, achieving arbitrary code execution within the ring 0 kernel context. Because HTTP.sys operates natively within the kernel, successful exploitation completely bypasses user-mode security controls and grants the attacker local privilege escalation to SYSTEM level. The attack vector is local, requiring an authorized user account, and the payload behavior targets core operating system memory stability and access control enforcement."
}