CVE-2026-47291: Remote Code Execution in Windows HTTP.sys (Kernel-Mode Integer Overflow) — Threadlinqs Intelligence
As of 2026-07-19, CVE-2026-47291: Remote Code Execution in Windows HTTP.sys (Kernel-Mode Integer Overflow) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1545 · Severity: CRITICAL · CVSS: 9.8 · Status: PATCHED · Category: VULNERABILITY
A 16-bit integer overflow in the Windows HTTP.sys kernel-mode driver's buffer-reference array growth logic allows an unauthenticated remote attacker to trigger a kernel pool heap buffer overflow
CVE-2026-47291 is a critical (CVSS 9.8) remote code execution vulnerability in HTTP.sys, the kernel-mode HTTP protocol stack driver that underlies IIS, WinRM, and numerous other Windows network services. The root cause is an integer overflow (CWE-190) that leads to a heap-based buffer overflow (CWE-122) in kernel pool memory.
During HTTP/1.x header parsing, HTTP.sys maintains a per-request state object containing a buffer reference array that grows dynamically as headers are received. The growth routine computes the new allocation size as 0x28 + capacity * 8 bytes, copies existing array contents via memmove using count * 8 as the copy length, and increments capacity by 5 using 16-bit unsigned integer addition. After 13,107 growth events the capacity field reaches 0xFFFB (65,531); the next growth operation adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. The subsequent memmove then copies roughly 524,256 bytes (approximately 65,532 buffer references * 8 bytes) into an allocation sized for a near-zero capacity (0x28 = 40 bytes), corrupting adjacent kernel pool memory and enabling arbitrary code execution in kernel context.
Exploitation requires an attacker to send a single crafted HTTP/1.x request over a TLS connection to a listener where the registry value MaxRequestBytes has been explicitly raised above the Windows default of 16,384 bytes to 65,535 bytes or higher (the vulnerability is not reachable at Windows' out-of-box default MaxRequestBytes configuration). Each header line must be encapsulated in a separate TLS application-data record so that each record maps to one buffer-reference-array growth event; roughly 65,536 buffer references are required to trigger the wraparound, producing a minimum total request size of approximately 262,144 bytes. Researchers estimate the exploitation primitive alone (excluding shellcode delivery/staging) can take on the order of 10+ minutes to complete at typical TLS record pacing.
HTTP.sys sits below IIS and any Windows Server Message Block/HTTP-based service in the network stack, meaning any service built on the Windows HTTP Server API (IIS, WinRM, SCCM/ConfigMgr components, Windows Admin Center, and various first- and third-party services that register HTTP.sys listeners) is a potential attack surface if the registry precondition is met. The flaw only affects the HTTP/1.x parser path; HTTP/2 and HTTP/3 requests are parsed by different code and are not vulnerable to this specific overflow.
Microsoft's June 2026 patch migrates the capacity/count tracking variables from 16-bit to 32-bit integer types and adds explicit boundary checks prior to buffer reallocation, closing the wraparound condition. The vulnerability was discovered and reported to Microsoft by Yazhi Wang and Jonathan Lein of the TrendAI Research team, and full technical details were published by Trend Micro's Zero Day Initiative (ZDI) on July 9, 2026, roughly one month after the patch shipped. A public proof-of-concept repository referencing this CVE has since appeared on GitHub, increasing near-term exploitation risk for unpatched, internet-facing Windows HTTP.sys listeners that have MaxRequestBytes raised above the vulnerable threshold (a configuration seen in environments that increased request-size limits to support large file uploads, SOAP/XML payloads, or certain enterprise application workloads).
Weaknesses (CWE)
CWE-190, CWE-122
Target sectors: government administration, finance, health, technology, manufacturing, education, retail, energy, telecoms
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-47291, T1190, T1203, T1068, T1211, T1070, T1046, T1082, T1499, T1529, T1071
