Heap Buffer Overflow in Windows HTTP.sys Enables Local Privilege Escalation
CVSS 3.1
7.8high
EPSS
<1%p40
Published
()
Modified
AI analysis
CVE-2026-62735 is a heap-based buffer overflow (CWE-122) in Windows HTTP.sys, the kernel-mode HTTP protocol stack driver, caused by an integer overflow in a size calculation (CWE-190); it is tracked by ZDI as ZDI-26-536 and originates from a Pwn2Own demonstration. A local, low-privileged (authorized) attacker can trigger the flaw by sending specially crafted HTTP requests that are processed by the kernel's HTTP.sys driver, corrupting heap memory in kernel mode. Successful exploitation allows the attacker to elevate from a low-privileged account to kernel-level (SYSTEM-equivalent) privileges, fully compromising the host with high impact on confidentiality, integrity, and availability. Affected because HTTP.sys ships with every installation, the impacted products span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012, 2016, 2019, and 2022. There is currently no public proof-of-concept, no known in-the-wild exploitation, and EPSS estimates only a 0.5% probability of exploitation within 30 days.
What to do: Apply the HTTP.sys security update referenced in Microsoft's advisory for CVE-2026-62735 on all listed Windows 10/11 and Windows Server builds, prioritizing Windows Server and multi-user hosts (RDS servers, shared workstations, dev/build servers) where untrusted low-privileged users run code; verify remediation by comparing the installed OS build number against the fixed builds published in the advisory rather than relying on the feature-update label. No public PoC or in-the-wild exploitation is reported (EPSS 0.5%, not in CISA KEV), so a normal prioritized patch cycle is defensible, but treat Pwn2Own-origin kernel bugs as likely targets for rapid exploit development. Because the attack path is local, network-level mitigations do not apply; as an interim measure, limit unprivileged logon…
Affected
Microsoft Windows 10
1607, 1809, 21H2, 22H2 (specific affected builds per Microsoft's advisory)
Microsoft Windows 11
23H2, 24H2, 25H2, 26H1 (specific affected builds per Microsoft's advisory)
Microsoft Windows Server
2012, 2016, 2019, 2022 (specific affected builds per Microsoft's advisory)
Estimated exposure
mass~1 billion+ Windows installations (Windows 10/11 alone has ~1.4 billion monthly-active devices) plus millions of Windows Server instances — HTTP.sys is a core component shipped by default on every Windows 10, Windows 11, and Windows Server installation, so exposure approximates the installed base of the listed versions — roughly a billion-plus clients based on Microsoft's…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 23h2, windows 11 24h2, windows 11 25h2, windows 11 26h1, windows server 2012, windows server 2016, windows server 2019, windows server 2022
ZDI discloses CVE-2026-62735, a Pwn2Own-demonstrated Windows http.sys integer overflow (CVSS 8.8) enabling local privilege escalation.
ZDI advisory ZDI-26-536 describes an integer overflow in Microsoft Windows http.sys, tracked as CVE-2026-62735 with a CVSS score of 8.8. The flaw was demonstrated at Pwn2Own and allows local attackers to escalate privileges on affected Windows installations. Exploitation requires first obtaining the ability to execute low-privileged code on the target system.