ZDI-26-536: (Pwn2Own) Microsoft Windows http.sys Integer Overflow Local Privilege Escalation Vulnerability
ZDI discloses CVE-2026-62735, a Pwn2Own-demonstrated Windows http.sys integer overflow (CVSS 8.8) enabling local privilege escalation.
ZDI advisory ZDI-26-536 describes an integer overflow in Microsoft Windows http.sys, tracked as CVE-2026-62735 with a CVSS score of 8.8. The flaw was demonstrated at Pwn2Own and allows local attackers to escalate privileges on affected Windows installations. Exploitation requires first obtaining the ability to execute low-privileged code on the target system.
- CVE-2026-62735: integer overflow in Windows http.sys
- CVSS 8.8 local privilege escalation
- Bug demonstrated at Pwn2Own competition
- Requires prior low-privileged code execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-62735 | Heap Buffer Overflow in Windows HTTP.sys Enables Local Privilege Escalation CVE-2026-62735 is a heap-based buffer overflow (CWE-122) in Windows HTTP.sys, the kernel-mode HTTP protocol stack driver, caused by an integer overflow in a size calculation (CWE-190); it is tracked by ZDI as ZDI-26-536 and originates from a Pwn2Own demonstration. A local, low-privileged (authorized) attacker can trigger the flaw by sending specially crafted HTTP requests that are processed by the kernel's HTTP.sys driver, corrupting heap memory in kernel mode. Successful exploitation allows the attacker to elevate from a low-privileged account to kernel-level (SYSTEM-equivalent) privileges, fully compromising the host with high impact on confidentiality, integrity, and availability. Affected because HTTP.sys ships with every installation, the impacted products span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012, 2016, 2019, and 2022. There is currently no public proof-of-concept, no known in-the-wild exploitation, and EPSS estimates only a 0.5% probability of exploitation within 30 days. Do: Apply the HTTP.sys security update referenced in Microsoft's advisory for CVE-2026-62735 on all listed Windows 10/11 and Windows Server builds, prioritizing Windows Server and multi-user hosts (RDS servers, shared workstations, dev/build servers) where untrusted low-privileged users run code; verify remediation by comparing the installed OS build number against the fixed builds published in the advisory rather than relying on the feature-update label. No public PoC or in-the-wild exploitation is reported (EPSS 0.5%, not in CISA KEV), so a normal prioritized patch cycle is defensible, but treat Pwn2Own-origin kernel bugs as likely targets for rapid exploit development. Because the attack path is local, network-level mitigations do not apply; as an interim measure, limit unprivileged logon… | 7.8 | <1% |
| mass~1 billion+ Windows installations (Windows 10/11 alone has ~1.4 billion monthly-active devices) plus millions of Windows Server instances |
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-62735.
This source does not provide full text. Read it at zerodayinitiative.com.