Description

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-11T17:18:27.903Z",
  "pubdate": "2026-08-11T17:18:27.903Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability resides within the Windows HTTP.sys component, specifically impacting the Windows operating system kernel-mode HTTP protocol stack.\nSuccessful exploitation of this memory corruption flaw allows an authorized local attacker to execute arbitrary code within kernel space, directly resulting in local privilege escalation to system level.\nThe vulnerability affects systems running vulnerable versions of Windows utilizing the HTTP.sys driver for handling HTTP requests.\nRisk implications are severe due to the execution context; achieving kernel-level code execution grants the attacker complete control over the compromised operating system, bypassing standard security boundaries and access controls.\nAttacker capabilities include complete system compromise, installation of unauthorized kernel-mode drivers, manipulation of system memory, and evasion of user-mode security telemetry.\nExploitation requirements dictate that the attacker must already possess local access to the target system and be authorized to interact with the local HTTP infrastructure, typically requiring execution of a specially crafted payload or application on the host.",
  "technicalDetails": "The vulnerability is fundamentally a heap-based buffer overflow located in the kernel-mode driver HTTP.sys.\nThe root cause stems from improper boundary checking and insufficient validation of input data lengths when processing HTTP requests within the affected component.\nWhen HTTP.sys allocates memory buffers on the kernel heap to store incoming request headers or URI structures, a discrepancy between the allocated buffer size and the actual data copied into the buffer occurs if an attacker supplies maliciously crafted, oversized input.\nThis arithmetic mismatch or missing bounds check results in heap memory corruption, allowing adjacent kernel pool structures, function pointers, or object vftables to be overwritten with attacker-controlled data.\nThe attack flow begins with the local attacker authenticating or interacting locally with the HTTP service managed by HTTP.sys.\nThe attacker sends a specially crafted HTTP request containing an oversized payload targeted at the vulnerable parsing routines within HTTP.sys.\nAs the kernel-mode driver processes the malformed request, the heap buffer overflows, corrupting adjacent heap metadata or critical kernel objects.\nBy meticulously crafting the payload size and content, the attacker redirects execution flow to malicious shellcode running in Ring 0.\nPrivilege requirements dictate that the attacker must have local execution capabilities on the target machine, though the specific execution context can be unprivileged user space before triggering the flaw.\nNetwork exposure is strictly local or restricted to the local machine interface depending on the service configuration, as the vulnerability is triggered via local interaction with the HTTP stack.\nPost-exploitation impact includes full local privilege escalation, transitioning from a standard user context to NT AUTHORITY\\SYSTEM, enabling complete persistence, disabling endpoint detection systems, and compromising the entirety of the host operating system."
}