Description

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:34.880Z",
  "pubdate": "2026-08-11T17:18:34.880Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability resides within the Windows HTTP.sys component, specifically impacting Microsoft Windows operating systems. This security flaw enables a locally authenticated attacker to execute arbitrary code within kernel context, ultimately leading to local privilege escalation.\nThe vulnerability stems from improper bounds checking during memory allocation and data processing within the HTTP kernel driver. An attacker capable of executing code locally on a target system can craft and send malicious requests designed to overflow the allocated heap buffer in HTTP.sys. Successful exploitation results in memory corruption, allowing the attacker to bypass security boundaries, elevate their privilege level to SYSTEM, and execute unauthorized administrative actions.\nExploitation requires the attacker to have prior local access to the system and authorization to interact with the HTTP stack. While network exposure is not strictly required for this local attack vector, the severity of the impact is exceptionally high due to the kernel-mode execution privileges associated with the HTTP.sys driver. The risk implications include complete system compromise, unauthorized data access, and potential installation of persistent malicious payloads.",
  "technicalDetails": "The vulnerability exists within HTTP.sys, the HTTP protocol stack implemented as a core operating system driver in Microsoft Windows. Specifically, the flaw manifests as a heap-based buffer overflow during the parsing and handling of specific HTTP requests or internal data structures managed by the driver.\nThe root cause of the vulnerability is the lack of proper input validation and insufficient boundary checks prior to copying input data into a dynamically allocated heap buffer. When the vulnerable component processes a specially crafted sequence of bytes supplied by an application or local user, the amount of data written exceeds the allocated buffer size. This results in an out-of-bounds write condition that corrupts adjacent memory regions within the kernel heap.\nThe attack flow proceeds as follows. First, the authenticated local attacker initializes communication with the local HTTP listener or invokes APIs that interact directly with the HTTP.sys driver. Second, the attacker transmits a maliciously crafted input payload designed to trigger the unsafe memory copy operation. Third, as HTTP.sys processes the input, the heap buffer overflows, overwriting critical kernel data structures, function pointers, or object metadata residing in adjacent heap memory.\nBy carefully controlling the size and content of the overflow data, the attacker can manipulate corrupted kernel pointers or function execution flows. This enables the redirection of execution to malicious shellcode running with maximum privileges. Because HTTP.sys operates within kernel mode (Ring 0), successful exploitation grants the attacker full kernel execution capabilities. Post-exploitation impact includes the ability to disable security defenses, modify kernel memory, read sensitive system data, and create administrative user accounts, thereby achieving complete system compromise."
}