CVE-2026-47291

This is a critical kernel-level remote code execution vulnerability in HTTP.sys affecting Windows 10 version 1607, and the CVSS 9.8 score actually understates the practical risk. Windows 10 1607 reached end-of-support in April 2023 — no official patch will come from Microsoft. The CVSS rating is technically accurate (unauthenticated network exploitation, SYSTEM-level code execution, total impact), but it assumes a remediation path exists. For organizations still running 1607 in production, this is a known critical flaw with no vendor-provided fix. HTTP.sys processes every incoming HTTP request at kernel level before it reaches any application. An integer overflow in parsing malformed HTTP/1.1 headers (specifically Content-Length values exceeding INT_MAX) allows an attacker to corrupt kernel heap memory and achieve arbitrary code execution at SYSTEM privilege — the highest privilege level on Windows. The EPSS score of 0.2275 indicates roughly a 23% probability of active exploitation within 30 days, and this probability will climb rapidly once public exploit code emerges. For immediate defense: network-level filtering that rejects malformed HTTP/1.1 request headers with Content-Length values exceeding INT_MAX can block the exploit trigger without disabling HTTP.sys entirely. Alternatively, disable HTTP.sys completely via registry at HKLM\System\CurrentControlSet\Services\HTTP (set Start=4), but this breaks IIS, Windows Update, WinRM, and potentially other core services — severe operational impact that makes this a last resort. Enabling Driver Signature Enforcement through Secure Boot and HVCI blocks unsigned kernel driver exploitation but requires hardware compatibility validation. Microsoft has issued emergency patches for critical kernel vulnerabilities in out-of-support systems before (WannaCry in 2017 covered Windows XP and Server 2003), but there's no guarantee they'll do so here. Organizations running 1607 should prioritize migration timelines over compensating controls as the only viable long-term risk reduction.

Reviewed through automated stages and approved by a human before publication.