Microsoft has disclosed CVE-2026-47291, a critical (CVSS 9.8) integer overflow in the Windows HTTP.sys kernel driver that lets an unauthenticated attacker execute code remotely over a network.
What Is It
CVE-2026-47291 is an integer overflow or wraparound vulnerability (CWE-190) in Windows HTTP.sys, the kernel-mode driver that handles HTTP request processing. According to Microsoft's record, the flaw "allows an unauthorized attacker to execute code over a network." It is also associated with a heap-based buffer overflow weakness (CWE-122), consistent with an overflow condition that leads to memory corruption.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practical terms, it is exploitable across the network, requires low attack complexity, needs no privileges, and requires no user interaction; while delivering high impact to confidentiality, integrity, and availability. Because HTTP.sys runs in kernel mode and underpins IIS and other Windows HTTP services, an unauthenticated, network-reachable RCE of this class is among the most severe categories of Windows flaw.
No CISA KEV entry was supplied for this CVE, so active exploitation is not confirmed in the available source material.
What's Vulnerable
The supplied data identifies the affected component as Windows HTTP.sys. No specific affected product versions or CPE entries were provided in the NVD record at the time of writing. The CVE was published by Microsoft ([email protected]) and is currently marked "Undergoing Analysis."
Patch Status
Microsoft has published guidance for this vulnerability through its Security Update Guide. Administrators should consult the MSRC advisory below for affected versions and apply available updates. No required-action deadline from CISA KEV was present in the supplied material.
Sources
- Microsoft Security Update Guide; CVE-2026-47291: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291