Microsoft Windows HTTP.sys: Local privilege escalation via double free

Summary

A double free vulnerability (CWE-415) in the Windows HTTP.sys kernel-mode HTTP listener allows an authorized local user to elevate privileges. The attack requires a valid low-privilege account on the system and high attack complexity, so it is not remotely exploitable from the internet. An attacker who already has a foothold, for example via a phished user or compromised service account, could gain SYSTEM rights, with high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds below 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds below 10.0.17763.9487
• Windows 10 Version 21H2 and 22H2: builds below 10.0.19044.7846 and 10.0.19045.7846
• Windows 11 Version 23H2: builds below 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2: fixed build for 25H2 is 10.0.26200.9974; 24H2 build unconfirmed
• Windows 11 Version 26H1: builds below 10.0.28000.3501
• Windows 11 Version 26H2: builds below 10.0.26300.9974
• Windows Server 2022: builds below 10.0.20348.5870
• Windows Server 2025: unconfirmed

Fixed in

• Fixed in the November 2026 Patch Tuesday security updates (released November 10, 2026).
• Fixed thresholds per CVE record: 10.0.14393.9688 (1607/2016), 10.0.17763.9487 (1809/2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2, unconfirmed), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (2022).
• Build numbers conflict between sources; verify them on the MSRC page before relying on them.

Workaround

Unknown. No vendor workaround or mitigation was found. Apply the security update.

Exploitation

• MSRC states that no public exploit code exists or that an exploit is only theoretical.
• Rapid7 rates exploitation as "More Likely" and reports no public disclosure.
• No in-the-wild exploitation of this CVE was found; a reported exploited flaw in the November release is linked to a different vulnerability (Outlook spoofing).
• CVSS temporal vector E:U (unproven). CISA SSVC: exploitation none, automatable no, technical impact total.
• NVD status at time of analysis: Awaiting Analysis.

Our recommendation

• Install the November 2026 Windows security update on all listed systems through Windows Update or WSUS, and verify the build number against the MSRC page.
• Prioritise multi-user servers, terminal/RDS servers and workstations with many local users; patch these first.
• Reduce local risk by enforcing least privilege and limiting local administrator rights.
• Monitor for unusual privilege changes or new SYSTEM processes on affected hosts.
• Re-check NVD and CISA KEV for changes in exploitation status.
• Windows 10 systems under Extended Security Updates are included.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-119992 msrc.microsoft.com
• CVE Record CVE-2026-119992 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
• Strix: CVE-2026-119992 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:24.