Description

Integer underflow (wrap or wraparound) in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:26.010Z",
  "pubdate": "2026-08-11T17:18:26.010Z",
  "executiveSummary": "An integer underflow, also known as a wrap or wraparound condition, exists within the Windows HTTP.sys component. This vulnerability allows an authorized local attacker to achieve an elevation of privileges, potentially granting them administrative or higher integrity execution states on the targeted system.\nThe affected product is Microsoft Windows, specifically involving the HTTP.sys kernel-mode driver, which handles HTTP requests and responses. The risk implication is significant because a successful exploit permits a local user to break out of their standard security context, bypassing operating system access controls.\nAttacker capabilities are constrained by prerequisite requirements; the adversary must already possess authorized access to execute code locally on the target system. Exploitation involves manipulating integer calculations within the vulnerable component to trigger memory corruption or logic flaws, leading to unauthorized privilege escalation.",
  "technicalDetails": "The vulnerability resides in the Windows HTTP.sys kernel-mode driver, specifically within routines that process incoming HTTP traffic and calculate buffer allocations or index offsets. The root cause is an integer underflow condition, occurring when a mathematical operation results in a value below the minimum allowable limit for the specified integer type, causing a wrap or wraparound effect.\nBecause HTTP.sys operates within kernel space (RING 0), improper validation of arithmetic inputs during request parsing leads to flawed memory management calculations. Specifically, when an attacker provides manipulated input data, the resulting integer wrap can cause memory allocation routines to reserve buffers that are significantly smaller than intended. Subsequent write or copy operations based on the original, un-wrapped size lead to heap-based buffer overflows or out-of-bounds memory manipulation within kernel memory.\nThe attack flow proceeds as follows: First, the authorized local attacker crafts a specialized payload or sequence of local HTTP requests directed at the local HTTP server stack managed by HTTP.sys. Second, the HTTP.sys driver parses the crafted input, triggering the vulnerable arithmetic operation that results in an integer underflow. Third, the resulting wraparound calculation misleads the memory allocation mechanism, causing a discrepancy between expected and actual buffer sizes. Fourth, the driver processes further data into the improperly sized buffer, generating memory corruption.\nBy carefully controlling the corrupted kernel memory layout, the attacker can manipulate critical kernel objects or function pointers. Execution of this corrupted state allows the attacker to overwrite security descriptors, token privileges, or process structures, ultimately mapping their current execution thread to a security context with elevated privileges, such as SYSTEM.\nThe vulnerability requires local access, meaning the attacker must have an interactive shell or the ability to execute code locally on the machine. Authentication is required to the extent that the actor must be an authorized user capable of interacting with local services managed by HTTP.sys. Network exposure is strictly local, as the attack vector targets internal kernel interfaces rather than remote network ports, though remotely triggerable variants rely on distinct attack surfaces."
}