ZDI-26-536: (Pwn2Own) Microsoft Windows http.sys Integer Overflow Local Privilege Escalation Vulnerability
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 7.8
- EPSS
- 0%
Affected versions
Key insight
The flaw was demonstrated at Pwn2Own and allows an attacker who already has local code execution to escalate privileges on Windows systems; public exploit code is therefore fundamentally likely.
Description
Microsoft Windows contains an integer overflow vulnerability in the HTTP stack http.sys, tracked as CVE-2026-62735 and published by the Zero Day Initiative as ZDI-26-536. Exploitation requires the attacker to already be able to execute low-privileged code on the target system; if successful, this can be leveraged to escalate to higher privileges. ZDI rates the vulnerability with a CVSS score of 8.8. The flaw was demonstrated during the Pwn2Own competition, which indicates feasible and reproducible exploitation. The advisory does not include any information about active exploitation in the wild or inclusion in the CISA KEV list.
Risk score
- cvss base
- 78.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 93.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 31.00
- vendor mismatch penalty
- 0.00
Path: operational
MITRE ATT&CK mapping
1 TTPProcedure details
| Technique | Tactic | Procedure | Conf. | Source |
|---|---|---|---|---|
| T1068 Exploitation for Privilege Escalation | Privilege Escalation | Exploits an integer overflow vulnerability in Microsoft Windows http.sys to escalate privileges from low-privileged code execution to higher integrity level. | high | llm |