Heap-based buffer overflow in Windows HTTP.sys

CVE-2026-62735 is an integer overflow in the UlpCreateInternalResponseOld function within Windows HTTP.sys, the kernel-mode HTTP protocol stack driver. When calculating header-buffer sizes, the driver wraps an integer, allocates an undersized heap buffer, then copies attacker-controlled header data past the end of it. A low-privileged local user can trigger this by sending an oversized HTTP response (~70,000 custom headers) via a specific IOCTL to the driver, corrupting the kernel pool and hijacking execution flow to achieve SYSTEM privileges. Every supported Windows version is affected: Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025.

Microsoft's HIGH / 7.8 rating is accurate. The CVSS vector correctly reflects local access, low privileges, and no user interaction. The vendor isn't sandbagging — the local-only attack vector is a genuine constraint that separates this from the truly catastrophic remote HTTP.sys bugs of the past (like CVE-2021-31166). What the score doesn't fully convey is the *universality* of the target: HTTP.sys is loaded on every Windows installation, and the PoC — demonstrated at Pwn2Own Berlin 2026 by Siyeon Wi and now fully public — means any red-teamer or post-access implant can bolt this on trivially.

Why this verdict

• Public PoC lowers the bar to zero: Siyeon Wi's Pwn2Own demonstration and subsequent full PoC publication mean any post-access operator can add this to their toolkit. The exploit is not theoretical — it was demonstrated live and the code is available.
• Universal attack surface: HTTP.sys ships as a default kernel-mode driver on every Windows version from Server 2012 through Windows 11 26H1. There is no configuration that removes it. Every Windows host in your fleet is a valid target once an attacker has local access.
• Role multiplier — DC / Hyper-V / backup server: On a domain controller, SYSTEM privileges from this exploit yield effective domain-admin access (DCSync, krbtgt extraction, GPO manipulation). On Hyper-V hosts, SYSTEM can access VM configurations. On backup admin servers (Veeam, Commvault), SYSTEM means backup-data exfiltration. These high-value roles represent a significant fraction of Windows Server installations, establishing a HIGH floor.
• Local-only vector provides meaningful friction: AV:L means the attacker must already have a foothold — this cannot be sprayed across the internet. Each target requires a prior compromise step, which compounds defensive opportunities (phishing defenses, EDR, network segmentation).
• VBS/HVCI and kCFG add modern-build friction: On Windows 11 and Server 2025 with VBS and Hypervisor-protected Code Integrity enabled, kernel code execution from a heap overflow is significantly harder. Enterprises running modern hardened builds have a real mitigation layer, though legacy Server 2016/2019 fleets do not.

Why not higher?

The local access vector (AV:L) is the hard constraint preventing a CRITICAL rating. Unlike remote HTTP.sys bugs (CVE-2021-31166, CVE-2022-21907), this cannot be weaponized for initial access or worm-like propagation. The attacker must already be inside the perimeter and on the target host. Additionally, there is no confirmed in-the-wild exploitation and the bug is not KEV-listed, so urgency is elevated but not emergency-tier.

Why not lower?

The role-multiplier floor prevents any downgrade below HIGH. HTTP.sys is not an optional component — it is present on 100% of Windows installations, including every domain controller, every Hyper-V host, and every backup server in a Windows environment. SYSTEM on these hosts is fleet-compromise-scale impact. The public PoC eliminates any complexity discount. Even with the local-access prerequisite, this is exactly the kind of LPE that ransomware operators and APTs chain after initial phishing or RDP compromise.

1. Enable VBS and HVCI on all supported hosts — Virtualization-Based Security and Hypervisor-protected Code Integrity prevent unsigned kernel code execution, which breaks the exploit's final stage. Deploy via Group Policy (Turn On Virtualization Based Security) or Intune baseline. Prioritize domain controllers and Hyper-V hosts. Target deployment within 30 days per the noisgate mitigation SLA for HIGH severity.
2. Enforce WDAC or AppLocker to block unauthorized binaries — Application control prevents the PoC executable (or any attacker-compiled binary) from running. This doesn't block the vulnerability but blocks the known exploitation tool. Deploy in audit mode first, then enforce on servers within 30 days.
3. Restrict interactive logon on high-value servers — Limit which accounts can log on interactively to domain controllers, Hyper-V hosts, and backup servers. Use Group Policy 'Allow log on locally' and 'Deny log on through Remote Desktop Services' to minimize the pool of accounts that could trigger the exploit. This directly raises the cost of step 1 in the attack chain.
4. Deploy kernel exploit detection rules in EDR — Enable kernel exploitation heuristics in CrowdStrike, Defender for Endpoint, or SentinelOne. These detect anomalous kernel pool manipulation and token replacement patterns. Ensure coverage on all Windows servers within 30 days.
5. Prioritize patching on DCs, Hyper-V, and backup servers — If fleet-wide patching takes time, segment the rollout: patch domain controllers, hypervisors, ADCS servers, and backup infrastructure first. These are the hosts where SYSTEM = domain/fleet compromise. Complete within 30 days for these tiers.

Run on each target Windows host with local administrator privileges. Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-62735.ps1. The script checks the installed build number of HTTP.sys against the known patched builds from August 2026 Patch Tuesday.

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Check whether CVE-2026-62735 (HTTP.sys heap overflow) is patched.
.NOTES
    Compares http.sys file version against known-patched builds.
    Exit 0 = PATCHED, Exit 1 = VULNERABLE, Exit 2 = UNKNOWN
#>

$httpSysPath = "$env:SystemRoot\System32\drivers\http.sys"
if (-not (Test-Path $httpSysPath)) {
    Write-Output "UNKNOWN - http.sys not found at expected path"
    exit 2
}

$fileVersion = (Get-Item $httpSysPath).VersionInfo.FileVersionRaw
$major = $fileVersion.Major   # 10
$minor = $fileVersion.Minor   # 0
$build = $fileVersion.Build
$rev   = $fileVersion.Revision

Write-Output "Detected http.sys version: $major.$minor.$build.$rev"

# Patched build numbers from August 2026 Patch Tuesday
# Format: build -> minimum patched revision
$patchedRevisions = @{
    14393 = 9418   # Server 2016 / Win10 1607
    17763 = 9121   # Server 2019 / Win10 1809
    19044 = 7663   # Win10 21H2
    19045 = 7663   # Win10 22H2
    22621 = 5900   # Win11 22H2 (estimated)
    22631 = 5900   # Win11 23H2 (estimated)
    26100 = 3200   # Win11 24H2 / Server 2025 (estimated)
}

if ($major -ne 10 -or $minor -ne 0) {
    Write-Output "UNKNOWN - Unexpected OS major/minor version ($major.$minor)"
    exit 2
}

if ($patchedRevisions.ContainsKey($build)) {
    $requiredRev = $patchedRevisions[$build]
    if ($rev -ge $requiredRev) {
        Write-Output "PATCHED - http.sys $major.$minor.$build.$rev >= required $requiredRev"
        exit 0
    } else {
        Write-Output "VULNERABLE - http.sys $major.$minor.$build.$rev < required $requiredRev"
        exit 1
    }
} else {
    # Build not in our lookup table - could be newer or older
    if ($build -gt 26100) {
        Write-Output "PATCHED - Build $build is newer than known affected range (likely patched)"
        exit 0
    } elseif ($build -lt 14393) {
        Write-Output "UNKNOWN - Build $build is older than supported range (likely EOL and vulnerable)"
        exit 2
    } else {
        Write-Output "UNKNOWN - Build $build not in patch lookup table; verify manually"
        exit 2
    }
}

Sources

1. SecurityOnline — CVE-2026-62735 PoC and Technical Details
2. NVD — CVE-2026-62735 Detail
3. MITRE CVE Record — CVE-2026-62735
4. Tenable — CVE-2026-62735
5. SentinelOne Vulnerability Database — CVE-2026-62735
6. Qualys — Microsoft Patch Tuesday August 2026 Review
7. Feedly CVE Intelligence — CVE-2026-62735