CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
Strategic summary
The report describes a recently patched remote code execution vulnerability (CVE-2026-47291) in the Windows HTTP.sys driver. A remote unauthenticated attacker can trigger an integer overflow when the buffer reference array grows during HTTP/1.x header parsing by sending crafted HTTP packets. Successful exploitation can lead to a denial-of-service condition or, in the worst case, code execution with kernel privileges. This is relevant for Joel Traber AG in the manufacturing sector of the DACH region, as affected Windows servers running IIS or HTTP.sys may be exposed on the network.
Key findings
- CVE-2026-47291 affects the kernel-mode HTTP driver HTTP.sys in Microsoft Windows and allows remote code execution or denial-of-service.
- The root cause is an integer overflow in the size calculation of the buffer reference array during HTTP/1.x header parsing, due to insufficient bounds checking.
- A remote unauthenticated attacker can exploit the vulnerability by sending crafted HTTP packets; in the worst case, this leads to code execution with kernel privileges.
- Over HTTPS, each TLS record is decrypted separately and passed to the HTTP parser, which changes the attack surface compared to plaintext HTTP.
- The vulnerability has been recently patched; Joel Traber AG should prioritize updating affected Windows servers running IIS or HTTP.sys.
Relevance for you
The vulnerability enables unauthenticated remote attackers to achieve kernel-level code execution via specially crafted HTTP/1.x requests over TLS connections.
Mentioned CVEs
Risk score
- cvss base
- 98.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 113.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 60.00
- vendor mismatch penalty
- 0.00
Path: operational
MITRE ATT&CK mapping
3 TTPsProcedure details
| Technique | Tactic | Procedure | Conf. | Source |
|---|---|---|---|---|
| T1190 Exploit Public-Facing Application | Initial Access | A remote unauthenticated attacker exploits CVE-2026-47291 by sending specially crafted HTTP/1.x requests over TLS to Windows HTTP.sys (IIS), triggering an integer overflow during HTTP header parsing that can result in kernel-level code execution or denial of service. | high | llm |
| T1499.004 Application or System Exploitation | Impact | Successful exploitation of CVE-2026-47291 can cause unexpected system termination due to a memory access exception in the kernel context, resulting in a denial-of-service condition against the targeted Windows server. | high | llm |
| T1068 Exploitation for Privilege Escalation | Privilege Escalation | Under specific memory layout conditions, exploitation of the integer overflow in HTTP.sys can lead to arbitrary code execution in the context of the Windows kernel, granting an attacker the highest level of system privileges. | high | llm |