# CVE-2026-47291: Remote Code Execution in Windows HTTP.sys (Kernel-Mode Integer Overflow)

> A 16-bit integer overflow in the Windows HTTP.sys kernel-mode driver's buffer-reference array growth logic allows an unauthenticated remote attacker to trigger a kernel pool heap buffer overflow exceeding 500 KB via crafted HTTP/1.x requests over TLS, resulting in remote code execution at kernel privilege. Patched by Microsoft in the June 2026 (June 9, 2026) Patch Tuesday cycle; Microsoft assesses exploitation as "more likely" though no confirmed in-the-wild exploitation or CISA KEV listing exists as of this writing.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1545
- **ID:** TL-2026-1545
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-47291

## Description

CVE-2026-47291 is a critical (CVSS 9.8) remote code execution vulnerability in HTTP.sys, the kernel-mode HTTP protocol stack driver that underlies IIS, WinRM, and numerous other Windows network services. The root cause is an integer overflow (CWE-190) that leads to a heap-based buffer overflow (CWE-122) in kernel pool memory.

During HTTP/1.x header parsing, HTTP.sys maintains a per-request state object containing a buffer reference array that grows dynamically as headers are received. The growth routine computes the new allocation size as 0x28 + capacity * 8 bytes, copies existing array contents via memmove using count * 8 as the copy length, and increments capacity by 5 using 16-bit unsigned integer addition. After 13,107 growth events the capacity field reaches 0xFFFB (65,531); the next growth operation adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. The subsequent memmove then copies roughly 524,256 bytes (approximately 65,532 buffer references * 8 bytes) into an allocation sized for a near-zero capacity (0x28 = 40 bytes), corrupting adjacent kernel pool memory and enabling arbitrary code execution in kernel context.

Exploitation requires an attacker to send a single crafted HTTP/1.x request over a TLS connection to a listener where the registry value MaxRequestBytes has been explicitly raised above the Windows default of 16,384 bytes to 65,535 bytes or higher (the vulnerability is not reachable at Windows' out-of-box default MaxRequestBytes configuration). Each header line must be encapsulated in a separate TLS application-data record so that each record maps to one buffer-reference-array growth event; roughly 65,536 buffer references are required to trigger the wraparound, producing a minimum total request size of approximately 262,144 bytes. Researchers estimate the exploitation primitive alone (excluding shellcode delivery/staging) can take on the order of 10+ minutes to complete at typical TLS record pacing.

HTTP.sys sits below IIS and any Windows Server Message Block/HTTP-based service in the network stack, meaning any service built on the Windows HTTP Server API (IIS, WinRM, SCCM/ConfigMgr components, Windows Admin Center, and various first- and third-party services that register HTTP.sys listeners) is a potential attack surface if the registry precondition is met. The flaw only affects the HTTP/1.x parser path; HTTP/2 and HTTP/3 requests are parsed by different code and are not vulnerable to this specific overflow.

Microsoft's June 2026 patch migrates the capacity/count tracking variables from 16-bit to 32-bit integer types and adds explicit boundary checks prior to buffer reallocation, closing the wraparound condition. The vulnerability was discovered and reported to Microsoft by Yazhi Wang and Jonathan Lein of the TrendAI Research team, and full technical details were published by Trend Micro's Zero Day Initiative (ZDI) on July 9, 2026, roughly one month after the patch shipped. A public proof-of-concept repository referencing this CVE has since appeared on GitHub, increasing near-term exploitation risk for unpatched, internet-facing Windows HTTP.sys listeners that have MaxRequestBytes raised above the vulnerable threshold (a configuration seen in environments that increased request-size limits to support large file uploads, SOAP/XML payloads, or certain enterprise application workloads).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1499 Endpoint Denial of Service
- T1529 System Shutdown/Reboot
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1505 Server Software Component
- T1587 Develop Capabilities
- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1210 Exploitation of Remote Services

## Sources

- [CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys](https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys)
- [Microsoft Security Response Center - CVE-2026-47291](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291)
- [CVE-2026-47291 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-47291)
- [CVE-2026-47291: Confirmed Windows HTTP.sys RCE - Patch Tuesday Priority Guide](https://windowsforum.com/threads/cve-2026-47291-confirmed-windows-http-sys-rce-patch-tuesday-priority-guide.424352/)
- [GitHub - ManagerEmpty/CVE-2026-47291-httpsys](https://github.com/ManagerEmpty/CVE-2026-47291-httpsys)
- [CVE-2026-47291: Inside the Critical HTTP.sys RCE That Demands Your Immediate Attention](https://cybersec-ai.xyz/blog/2026-06-20-cve-analysis/)
- [CVE-2026-47291 | CyberSIXT](https://cybersixt.com/cve/CVE-2026-47291)
- [Windows HTTP.sys Integer Overflow Enables Unauthenticated RCE, "Exploitation More Likely" (CVE-2026-47291)](https://cert.ug/windows-httpsys-integer-overflow-enables-unauthenticated-rce-exploitation-more-likely-cve-2026)
- [CVE-2026-47291 - Unauthenticated Remote Code Execution via Integer Overflow - Windows HTTP.sys](https://www.ionix.io/threat-center/cve-2026-47291/)
- [CVE-2026-47291: Critical Windows HTTP.sys RCE (CVSS 9.8)](https://zerodayhub.co.uk/2026/06/29/windows-http-sys-rce-cve-2026-47291/)
- [Microsoft Patch Tuesday for June 2026 - Snort rules and prominent vulnerabilities](https://blog.talosintelligence.com/microsoft-patch-tuesday-for-june-2026-snort-rules-and-prominent-vulnerabilities/)
- [June 2026 Patch Tuesday: Updates and Analysis](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-june-2026/)
- [Microsoft Releases June 2026 Patch Tuesday Updates](https://petri.com/microsoft-june-2026-patch-tuesday-updates/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1545