CVE-2026-47291: HTTP.sys Remote Code Execution Vulnerability

Synopsis

An integer overflow vulnerability in Windows HTTP.sys allows an unauthenticated remote attacker to execute arbitrary code on affected Windows systems. The flaw is reachable over the network with no credentials and no user interaction required, making it exploitable against any internet-exposed or network-accessible Windows host running an affected version of HTTP.sys. Successful exploitation gives the attacker full code execution in the context of the kernel-mode HTTP.sys driver, enabling complete host compromise. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target over the network, as HTTP.sys is a network-facing kernel driver that listens for inbound HTTP traffic.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable code path is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  Exploitation is fully automated from the attacker's side and requires no action from any user on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race timing, or memory-layout knowledge.

Blast Radius

• The attacker executes arbitrary code in the context of the kernel-mode HTTP.sys driver, giving immediate ring-0 level access on the host.
• All data accessible to the operating system, including credentials, secrets, and application data stored on disk or in memory, is readable by the attacker.
• The attacker can modify or delete any files, registry keys, or in-memory data structures on the compromised host.
• The attacker can crash the HTTP.sys driver or the entire host, taking all services on that system offline.