Windows HTTP.sys QUIC parsing out-of-bounds read denial of service

<#
.SYNOPSIS
    Checks whether the local host is patched against CVE-2026-33096
    (HTTP.sys OOB read DoS, April 2026 Patch Tuesday).
.NOTES
    Run on target host. No admin privileges required.
    Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'
try {
    $ntVer = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $buildNum = [int]$ntVer.CurrentBuildNumber
    $ubr = [int]$ntVer.UBR
    $displayVersion = $ntVer.DisplayVersion
    $productType = (Get-CimInstance Win32_OperatingSystem).ProductType
    # ProductType: 1 = Workstation, 2 = Domain Controller, 3 = Server
    $roleName = switch ($productType) { 1 {'Workstation'} 2 {'Domain Controller'} 3 {'Server'} default {'Unknown'} }
    $fullBuild = "10.0.$buildNum.$ubr"

    Write-Host "[CVE-2026-33096 Check]"
    Write-Host "OS Build   : $fullBuild"
    Write-Host "Version    : $displayVersion"
    Write-Host "Role       : $roleName"
    Write-Host ""

    # Fixed UBR thresholds per build number
    # Build 26100 has split thresholds: workstation (Win11 24H2) vs server (Server 2025)
    $fixedMap = @{
        22631 = @{ Threshold = 6936;  Label = 'Windows 11 23H2' }
        26200 = @{ Threshold = 8246;  Label = 'Windows 11 25H2' }
        28000 = @{ Threshold = 1836;  Label = 'Windows 11 26H1' }
        20348 = @{ Threshold = 5020;  Label = 'Windows Server 2022' }
        25398 = @{ Threshold = 2274;  Label = 'Windows Server 2022 23H2' }
    }

    $threshold = $null
    $label = $null

    if ($fixedMap.ContainsKey($buildNum)) {
        $threshold = $fixedMap[$buildNum].Threshold
        $label = $fixedMap[$buildNum].Label
    } elseif ($buildNum -eq 26100) {
        # Win11 24H2 (workstation) vs Server 2025 (server/DC)
        if ($productType -eq 1) {
            $threshold = 8246
            $label = 'Windows 11 24H2'
        } else {
            $threshold = 32690
            $label = 'Windows Server 2025'
        }
    } else {
        Write-Host "UNKNOWN - Build $buildNum is not in the affected product list."
        Write-Host "         This OS may not be vulnerable to CVE-2026-33096."
        exit 2
    }

    Write-Host "Product    : $label"
    Write-Host "Fixed UBR  : >= $threshold"
    Write-Host "Current UBR: $ubr"
    Write-Host ""

    if ($ubr -lt $threshold) {
        Write-Host "VULNERABLE - Build $fullBuild is below the fixed version ($threshold) for CVE-2026-33096." -ForegroundColor Red
        exit 1
    } else {
        Write-Host "PATCHED - Build $fullBuild meets or exceeds the fix for CVE-2026-33096." -ForegroundColor Green
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_" -ForegroundColor Yellow
    exit 2
}