Windows HTTP.sys: Elevation of privilege via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows HTTP.sys kernel driver allows an authorized local user to elevate privileges. The attacker needs a valid low-privilege account and a high-complexity attack. The CVE record does not describe the trigger, and no public technical write-up or proof of concept was found.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to < 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to < 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5870)

Fixed in

Install the November 2026 cumulative update. Fixed builds per the CNA record: 10.0.14393.9688 (1607, Server 2016), 10.0.17763.9487 (1809, Server 2019), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1), 10.0.20348.5870 (Server 2022).

• Windows 10 21H2 and 22H2 (19044.7846, 19045.7846) are listed by a third-party source only and must be verified on the MSRC page.
• Windows Server 2025 is not listed in the CNA record; verify on the MSRC page.

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild (CISA SSVC: Exploitation none, Automatable no).
• Rapid7 lists exploitation as less likely and publicly disclosed as no.
• No public proof of concept found.

Our recommendation

• Install the November 2026 security update on all affected Windows systems, starting with Windows 10 ESU hosts and servers running IIS or other HTTP.sys-based services.
• Verify the fixed build numbers on the MSRC advisory before relying on them.
• Limit local accounts and remove unneeded shared accounts to reduce the risk of local privilege escalation.
• Watch for a CISA KEV listing or public exploit code and check the NVD scoring once published.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95923 msrc.microsoft.com
• CVE Record CVE-2026-95923 (CVE.org) www.cve.org
• Strix AI: CVE-2026-95923 www.strix.ai
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Senserva: KB5131096 (Windows 10 21H2) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:03.