Integer overflow or wraparound in Windows HTTP

CVE-2026-47291 is an integer overflow (CWE-190 leading to CWE-122 heap overflow) in HTTP.sys, the Windows kernel-mode HTTP listener that fronts IIS, WinRM, WSUS, Exchange, RDP Web, ADFS, PowerShell Remoting over HTTPS, and any .NET/HttpListener app. The driver performs 16-bit arithmetic on request size; a header block ≥ 65,535 bytes wraps the allocation to a tiny value, then writes the full request into it — arbitrary code in ring 0. Affected: Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Server 2012 through 2025 including Server Core. Fixed in the June 2026 Patch Tuesday cumulative rollups.

Microsoft's 9.8 CRITICAL is technically correct for the CVSS math — unauthenticated, network, code execution, kernel context. But the vendor rating hides the single most important operational fact: the default HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\MaxRequestBytes is 16,384 bytes, well below the 65,535-byte overflow threshold. Boxes that were never tuned are not reachable. The population that IS reachable — WSUS, some SharePoint front-ends, load-balancer-fronted APIs, and shops that raised the ceiling to accept large SOAP/Kerberos tickets — is the population you actually need to hunt. That's why we hold at HIGH rather than downgrade further: when it lands, it lands in the kernel.

Why this verdict

• Configuration gate: default MaxRequestBytes=16,384 is below the 65,535 overflow threshold — the majority of installs are non-exploitable without an admin-driven tuning change.
• Front-door friction: reverse proxies, WAFs, and load balancers on production perimeters routinely cap header sizes to 8–16 KB, stripping the oversized request before HTTP.sys sees it.
• Weaponization gap: public PoC currently produces BSOD, not SYSTEM shell. HVCI/CET/CFG on Server 2022+ and Win11 further degrade exploit reliability.
• Role multiplier — WSUS/SCCM patch servers: these deployments frequently raise MaxRequestBytes for large update manifests and metadata pushes. Chain succeeds → attacker owns the patch distribution plane → fleet-scale supply-chain pivot. This is why we do not go below HIGH.
• Role multiplier — ADFS / AD CS Web Enrollment: commonly tuned upward for large Kerberos/SAML tokens. Chain end-state = domain-wide credential theft or rogue certificate issuance.
• Role multiplier — perimeter Exchange OWA / SharePoint: header ceilings frequently raised for federated auth blobs. Blast radius = mailbox tenant compromise.
• Kernel context: when the chain does land, it lands as ring-0 — bypasses every user-mode EDR heuristic and enables rootkit persistence. Impact severity is maxed even if reach is narrow.

Why not higher?

No confirmed in-the-wild exploitation, no KEV listing, no public weaponized RCE, and the default configuration is non-exploitable. CRITICAL is reserved for chains that hit a canonical fleet-scale role in default configuration; here the high-value-role hit requires the admin to have already opted into the exploitable state.

Why not lower?

The bug is a kernel-mode RCE in a driver that sits in front of WSUS, ADFS, AD CS Web Enrollment, and Exchange — canonical high-value-role infrastructure that is disproportionately tuned above the exploit threshold. EPSS is already at the 96th percentile with an active PoC author and DoS-grade code public; weaponized RCE is a matter of engineering time. MEDIUM would understate the blast radius on the exposed minority.

1. Verify and hard-cap MaxRequestBytes and MaxFieldLength below 65,535 on every HTTP.sys host — Set HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\MaxRequestBytes and MaxFieldLength to ≤ 32,768 (default is 16,384). This puts the host out of range of the overflow arithmetic. Deploy via GPO within the noisgate 30-day mitigation SLA for the HIGH bucket.
2. Enforce upstream header-size caps at the reverse proxy / WAF — Configure F5 HTTP::header sanitize, NetScaler HTTP profile reqTimeout + max header size, nginx large_client_header_buffers 4 8k, or Cloudflare Managed Rule 100294 to reject header blocks > 16 KB. This defends even when downstream Windows config drifts. Same 30-day window.
3. Enable HVCI / Memory Integrity on all Server 2022/2025 and Win11 hosts — Kernel-mode code integrity blocks the shellcode-execution stage of any working RCE payload. Roll out via Intune / GPO HypervisorEnforcedCodeIntegrity. Bake into standard image.
4. Apply the June 2026 cumulative update (KB5039217 / KB5039212 / distro equivalents) — This is the definitive fix — migrates size tracking to 32-bit and adds pre-allocation bounds checks. Target completion within the noisgate 180-day remediation SLA for HIGH, prioritizing WSUS/SCCM, ADFS, AD CS, Exchange, and any Internet-facing IIS ahead of workstations.
5. Add Suricata/Snort signature for header blocks > 60 KB — Deploy Suricata SID 2049112 to perimeter IDS to detect probing and eventual exploit attempts. Feed alerts to SIEM with a WSUS/ADFS asset tag correlation rule.

Run on each Windows target as local administrator (needed to read HKLM HTTP parameters and query Get-HotFix). Invoke: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-47291.ps1. Outputs VULNERABLE, PATCHED, or UNKNOWN and a non-zero exit code on VULNERABLE.

#requires -RunAsAdministrator
# Check-CVE-2026-47291.ps1 — HTTP.sys integer overflow assessment
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'

# 1. Patched KBs by product family (June 2026 rollups)
$fixedKBs = @('KB5039217','KB5039212','KB5039227','KB5039199','KB5039205')
$installed = Get-HotFix | Select-Object -ExpandProperty HotFixID
$patched = $false
foreach ($kb in $fixedKBs) { if ($installed -contains $kb) { $patched = $true; break } }

# 2. Read HTTP.sys config threshold
$httpParams = 'HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters'
$maxReq = (Get-ItemProperty -Path $httpParams -Name 'MaxRequestBytes' -EA SilentlyContinue).MaxRequestBytes
$maxField = (Get-ItemProperty -Path $httpParams -Name 'MaxFieldLength' -EA SilentlyContinue).MaxFieldLength
if ($null -eq $maxReq)   { $maxReq   = 16384 }   # Windows default
if ($null -eq $maxField) { $maxField = 16384 }

# 3. Is HTTP.sys actually loaded / listening?
$httpDriver = Get-Service -Name 'HTTP' -EA SilentlyContinue
$listening = $httpDriver -and $httpDriver.Status -eq 'Running'

Write-Host "[*] KB patch present     : $patched"
Write-Host "[*] MaxRequestBytes      : $maxReq"
Write-Host "[*] MaxFieldLength       : $maxField"
Write-Host "[*] HTTP.sys driver up   : $listening"

if ($patched) {
    Write-Host 'PATCHED' -ForegroundColor Green
    exit 0
}
if (-not $listening) {
    Write-Host 'PATCHED (HTTP.sys not running — not exposed)' -ForegroundColor Green
    exit 0
}
if ($maxReq -lt 65535 -and $maxField -lt 65535) {
    Write-Host 'PATCHED (config below overflow threshold — mitigated but still apply June 2026 CU)' -ForegroundColor Yellow
    exit 0
}
if ($maxReq -ge 65535 -or $maxField -ge 65535) {
    Write-Host 'VULNERABLE — missing June 2026 CU AND MaxRequestBytes/MaxFieldLength >= 65535' -ForegroundColor Red
    exit 1
}
Write-Host 'UNKNOWN' -ForegroundColor Yellow
exit 2

Sources

1. NVD — CVE-2026-47291
2. Uganda CERT advisory
3. IONIX threat center
4. Tenable CVE record
5. CVE.report — HTTP.sys RCE
6. CyberSec AI analysis
7. Public PoC — ManagerEmpty/CVE-2026-47291-httpsys
8. Strobes VI CVE detail