CVE-2026-47291
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
An integer overflow or wraparound vulnerability in Windows HTTP.sys allows an unauthorized attacker to execute code remotely over a network.
Risk Assessment
An attacker can remotely execute arbitrary code on a vulnerable Windows system, potentially leading to full server compromise.
Recommendation
Install the latest Windows security updates from Microsoft.
Other vulnerabilities in Windows HTTP.sys
See all- CVE-2026-69597High
Use after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
- CVE-2026-62811High
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-62753High
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-62741High
Integer underflow (wrap or wraparound) in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-62739High
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-62735High
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-61937High
Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-50420Medium
An out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally.
- CVE-2026-49787High
Unrestricted resource allocation vulnerability in Windows HTTP.sys. An unauthorized attacker can remotely cause a denial of service.
- CVE-2026-33096High
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
Original NVD description (English source)
Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS