CVE-2026-47291: Remote Code Execution in Windows HTTP.sys (Kernel-Mode Integer Overflow)

CVE-2026-47291 (TL-2026-1545) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-19. It has no confirmed attribution, affects Microsoft Windows HTTP.sys (HTTP Protocol Stack driver), references 1 CVE (CVE-2026-47291), maps to 17 MITRE ATT&CK techniques (T1046, T1068, T1070), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1545

Threat ID
TL-2026-1545
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-19
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, manufacturing, education, retail, energy, telecoms
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in CVE-2026-47291

Malware and tooling: CVE-2026-47291-httpsys (GitHub PoC)

A 16-bit integer overflow in the Windows HTTP.sys kernel-mode driver's buffer-reference array growth logic allows an unauthenticated remote attacker to trigger a kernel pool heap buffer overflow exceeding 500 KB via crafted HTTP/1.x requests over TLS, resulting in remote code execution at kernel privilege. Patched by Microsoft in the June 2026 (June 9, 2026) Patch Tuesday cycle; Microsoft assesses exploitation as "more likely" though no confirmed in-the-wild exploitation or CISA KEV listing exists as of this writing.

How CVE-2026-47291 works

CVE-2026-47291 is a critical (CVSS 9.8) remote code execution vulnerability in HTTP.sys, the kernel-mode HTTP protocol stack driver that underlies IIS, WinRM, and numerous other Windows network services. The root cause is an integer overflow (CWE-190) that leads to a heap-based buffer overflow (CWE-122) in kernel pool memory.

During HTTP/1.x header parsing, HTTP.sys maintains a per-request state object containing a buffer reference array that grows dynamically as headers are received. The growth routine computes the new allocation size as 0x28 + capacity * 8 bytes, copies existing array contents via memmove using count * 8 as the copy length, and increments capacity by 5 using 16-bit unsigned integer addition. After 13,107 growth events the capacity field reaches 0xFFFB (65,531); the next growth operation adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. The subsequent memmove then copies roughly 524,256 bytes (approximately 65,532 buffer references * 8 bytes) into an allocation sized for a near-zero capacity (0x28 = 40 bytes), corrupting adjacent kernel pool memory and enabling arbitrary code execution in kernel context.

Exploitation requires an attacker to send a single crafted HTTP/1.x request over a TLS connection to a listener where the registry value MaxRequestBytes has been explicitly raised above the Windows default of 16,384 bytes to 65,535 bytes or higher (the vulnerability is not reachable at Windows' out-of-box default MaxRequestBytes configuration). Each header line must be encapsulated in a separate TLS application-data record so that each record maps to one buffer-reference-array growth event; roughly 65,536 buffer references are required to trigger the wraparound, producing a minimum total request size of approximately 262,144 bytes. Researchers estimate the exploitation primitive alone (excluding shellcode delivery/staging) can take on the order of 10+ minutes to complete at typical TLS record pacing.

HTTP.sys sits below IIS and any Windows Server Message Block/HTTP-based service in the network stack, meaning any service built on the Windows HTTP Server API (IIS, WinRM, SCCM/ConfigMgr components, Windows Admin Center, and various first- and third-party services that register HTTP.sys listeners) is a potential attack surface if the registry precondition is met. The flaw only affects the HTTP/1.x parser path; HTTP/2 and HTTP/3 requests are parsed by different code and are not vulnerable to this specific overflow.

Microsoft's June 2026 patch migrates the capacity/count tracking variables from 16-bit to 32-bit integer types and adds explicit boundary checks prior to buffer reallocation, closing the wraparound condition. The vulnerability was discovered and reported to Microsoft by Yazhi Wang and Jonathan Lein of the TrendAI Research team, and full technical details were published by Trend Micro's Zero Day Initiative (ZDI) on July 9, 2026, roughly one month after the patch shipped. A public proof-of-concept repository referencing this CVE has since appeared on GitHub, increasing near-term exploitation risk for unpatched, internet-facing Windows HTTP.sys listeners that have MaxRequestBytes raised above the vulnerable threshold (a configuration seen in environments that increased request-size limits to support large file uploads, SOAP/XML payloads, or certain enterprise application workloads).

MITRE ATT&CK techniques used in TL-2026-1545

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070 Indicator Removal; T1211 Exploitation for Stealth

Command and Control

T1071 Application Layer Protocol; T1573 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1499 Endpoint Denial of Service; T1529 System Shutdown/Reboot

Persistence

T1505 Server Software Component

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CVE-2026-47291

  • Microsoft — Windows HTTP.sys (HTTP Protocol Stack driver)
    Vulnerable versions: Windows 10 Version 1607 (through 10.0.14393.9233); Windows 10 Version 1809 (through 10.0.17763.8879); Windows 10 Version 21H2/22H2 (through 10.0.19044/19045.7416); Windows 11 Version 23H2; Windows 11 Version 24H2; Windows 11 Version 25H2; Windows 11 Version 26H1; Windows Server 2016; Windows Server 2019; Windows Server 2022
    Fixed in: All above builds updated via the June 2026 (June 9, 2026) Microsoft cumulative security update
  • Microsoft — Internet Information Services (IIS)
    Vulnerable versions: IIS running on any unpatched HTTP.sys-affected Windows build with MaxRequestBytes raised above 65,535
    Fixed in: IIS on patched Windows builds

Remediation for CVE-2026-47291

Patches

  • Microsoft June 2026 Patch Tuesday (released June 9, 2026) cumulative updates for Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1) and corresponding Windows Server builds sharing the affected HTTP.sys binary

Immediate actions

  • Apply Microsoft's June 2026 (June 9, 2026) cumulative security update for all affected Windows client and Windows Server builds
  • Audit HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\MaxRequestBytes on all internet-facing and internal Windows HTTP.sys hosts (IIS, WinRM, WAC, SCCM) and reduce it to at or below 65,535 bytes if it has been raised above the Windows default
  • If patching cannot be completed immediately, set MaxRequestBytes to the Windows default (16,384 bytes) or any value at/below 65,535 bytes and restart the HTTP service (net stop http / net start http) to apply the mitigation
  • Inventory all Windows hosts exposing HTTP.sys-backed services (IIS, WinRM 5985/5986, Windows Admin Center, SCCM MP/DP roles) and prioritize patch validation on internet-facing systems first

Workarounds

  • Set MaxRequestBytes registry value to 65,535 or below (Windows default is 16,384) at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters and restart the HTTP.sys-dependent service stack
  • Restrict TLS-terminating HTTP.sys listeners (IIS sites, WinRM endpoints) to trusted network segments/VPN where immediate patching is not feasible
  • Where technically supported, prefer HTTP/2 or HTTP/3 listener bindings over HTTP/1.x for externally exposed services, since the vulnerable code path is specific to the HTTP/1.x header parser

Longer-term hardening

  • Deploy EDR/kernel-level behavioral detection capable of flagging anomalous HTTP.sys/kernel pool memory corruption crash signatures (bugcheck patterns) and post-exploitation kernel-mode code execution
  • Enforce configuration baselines (e.g., via Group Policy or DSC) that prevent MaxRequestBytes from being raised above safe thresholds without change-control review
  • Monitor for abnormally large HTTP/1.x requests (>200KB) with unusually granular TLS record fragmentation (near-1-header-per-TLS-record patterns) at network TLS termination points or via decrypted traffic inspection where SSL/TLS inspection is in place
  • Establish rapid Patch Tuesday validation SLAs for kernel-mode Windows networking-stack CVEs given historical wormable/mass-exploitation risk of HTTP.sys and comparable kernel HTTP-parsing flaws

CVEs associated with CVE-2026-47291

CVE-2026-47291

Weaknesses (CWE) in CVE-2026-47291

CWE-190, CWE-122

Timeline of CVE-2026-47291

  • Yazhi Wang and Jonathan Lein of the TrendAI Research team report the HTTP.sys integer overflow to Microsoft via the Zero Day Initiative program.
  • Microsoft Security Response Center publishes the CVE-2026-47291 advisory with CVSS 3.1 score 9.8 and an 'exploitation more likely' assessment.
  • Microsoft ships a fix for CVE-2026-47291 as part of the June 2026 Patch Tuesday cumulative security updates, migrating 16-bit tracking variables to 32-bit and adding boundary checks.
  • Security press (WindowsForum, Petri, CrowdStrike, Talos) covers CVE-2026-47291 as a top-priority Patch Tuesday item due to unauthenticated kernel RCE impact.
  • Independent vulnerability intelligence platforms (CyberSIXT, IONIX) publish exposure and remediation guidance, noting the MaxRequestBytes registry precondition.
  • CyberSec AI publishes an in-depth technical breakdown urging immediate patch prioritization.
  • ZeroDayHub publishes further technical analysis reiterating the CVSS 9.8 rating and mitigation steps.
  • A public proof-of-concept repository (ManagerEmpty/CVE-2026-47291-httpsys) referencing the vulnerability appears on GitHub, coinciding with the ZDI disclosure.
  • Trend Micro Zero Day Initiative publishes the full technical root-cause writeup, detailing the exact integer-overflow arithmetic (0x28 + capacity*8 allocation, 16-bit capacity wraparound at 0x10000) and exploitation mechanics.
  • Threat surfaced by TL-Intel-Harness RSS hunt pipeline from the Zero Day Initiative Blog feed for tracking/detection guidance given kernel-level RCE severity and now-public technical writeup plus PoC.

Sources cited for CVE-2026-47291

Threats related to CVE-2026-47291

Detection coverage for TL-2026-1545

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1545 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats