Product:
Windows HTTP.sys
Summary
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. This vulnerability can lead to significant service disruptions. Attackers can exploit this issue without needing any special privileges or user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-33096 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted network requests to the affected Windows HTTP.sys component. By manipulating the requests, the attacker can trigger the out-of-bounds read condition, leading to a denial of service. This can be done remotely, making it a significant threat to networked systems.
Affected Products
- Windows HTTP.sys: A core component of Windows that handles HTTP requests, vulnerable to denial of service attacks.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, network security measures such as firewalls and intrusion detection systems can help monitor and block malicious traffic targeting this vulnerability.