CVE-2026-47291

The vulnerability falls into the CWE-122 (heap-based buffer overflow) and CWE-190 (integer overflow or wraparound) categories. An attacker sends specially crafted HTTP requests to the HTTP.sys component, triggering an integer overflow that leads to a heap buffer overflow. This allows overwriting process memory and executing arbitrary code in the context of the operating system kernel. The vulnerability is remotely exploitable without authentication and without user interaction.

An attacker can remotely execute arbitrary code at Windows kernel level (kernel-mode RCE), gaining full control over the compromised host, including access to sensitive data, ability to modify the system, and potential lateral movement within the network.

Apply patches available from the vendor according to references: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291. Until the fix is deployed, consider restricting network access to services using HTTP.sys (e.g., IIS, WinRM) using a firewall.

Windows systems using the HTTP.sys driver — versions indicated in the vendor references (Microsoft Security Response Center).