Description

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:25.667Z",
  "pubdate": "2026-08-11T17:18:25.667Z",
  "executiveSummary": "This vulnerability is classified as a heap-based buffer overflow affecting the Windows operating system. Specifically, the flaw resides within the HTTP.sys component, which functions as the kernel-mode HTTP listener in Microsoft Windows architectures. Successful exploitation of this vulnerability permits an authorized local attacker to execute arbitrary code within kernel context, thereby achieving local privilege escalation to the highest integrity levels, such as NT AUTHORITY\\SYSTEM.\nThe risk implications are severe due to the kernel-mode execution privileges associated with the HTTP.sys driver. An adversary who has already established initial access or executed unprivileged code on the local system can leverage this flaw to bypass operating system security boundaries, disable security controls, install persistent rootkits, or pivot across enterprise environments. Exploitation requirements mandate that the attacker possesses prior authorized local access to the target host in order to interact with the vulnerable kernel component.\nAffected systems comprise vulnerable Microsoft Windows builds utilizing the standard HTTP.sys architecture. Given the critical nature of kernel-mode memory corruption vulnerabilities, remediation requires the immediate application of vendor-supplied security updates to patch the underlying memory management logic within the HTTP.sys driver.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient bounds checking and memory validation within the heap allocation and data parsing routines handled by the Windows HTTP.sys driver. When processing crafted HTTP requests or internal control structures, the component fails to accurately calculate buffer sizes before copying data into dynamically allocated heap memory buffers. This discrepancy results in a classic heap-based buffer overflow condition.\nThe vulnerable component is the kernel-mode driver file associated with the HTTP protocol stack in Microsoft Windows. The affected functionality processes incoming HTTP traffic and internal input/output control requests. Because HTTP.sys operates directly within kernel space (Ring 0), any memory corruption within its heap structures overwrites adjacent kernel pool memory, corrupting critical system objects, function pointers, or allocator metadata.\nRegarding authentication and privilege requirements, the attack vector is characterized as a local privilege escalation. The threat actor must already possess authorized local access to the operating system, typically executing under low-privileged accounts such as standard user or service accounts. The network exposure is strictly local, as the attack relies on local inter-process communication or local loopback interaction with the HTTP listener rather than direct remote exposure over external network interfaces, unless combined with a separate remote code execution vulnerability.\nThe step-by-step attack flow proceeds as follows. First, the attacker establishes execution capability locally on the target Windows system. Second, the attacker crafts a malicious input payload designed to trigger the unsafe memory allocation and copy routines within HTTP.sys. This is typically achieved by issuing specifically formatted HTTP requests or sending custom IOCTL commands to the driver. Third, as HTTP.sys parses the input, the lack of proper size validation causes the incoming data to exceed the allocated heap chunk boundaries. Fourth, the overflow corrupts adjacent heap metadata or critical kernel structures residing in the same memory pool. Fifth, by carefully engineering the heap layout and payload contents, the attacker redirects execution flow or overwrites function pointers. Finally, the malicious payload executes in kernel mode, allowing the attacker to alter process access tokens, grant SYSTEM privileges to their user context, and achieve complete compromise of the underlying operating system."
}